Protect against user-supplied values for generated metadata