Cherry pick security fix (#274) to 2-6-stable
Merge pull request #300 from Shopify/cherry_pick_security_fix_to_2-6-stable

Cherry pick security fix to 2-6-stable