security fix: constrain list names requested