fix(security): harden file access controls, webhook auth, and input bounds

fix(security): harden file access controls, webhook auth, and input bounds #16919