fix: A xss bug.
opt: Support the NODE_ENV variable.