[SECRUITY] Fix XSS vulnerability in API Callback