fix: filename validation