mention content security/path filtering