SECURITY: remove XSS vulnerability