How to identify and prevent insecure output handling