fix(builder): do not accept variables from the client