Security issue: add validation of script names