SECURITY: check filenames in editor