fix(security): defense in depth — input-path cap + cache read-path si…

fix(security): defense in depth — input-path cap + cache read-path si… #181