Security audit and hardening: fix timing attacks, plugin loading vulnerabilities, and input validation bypasses

Security audit and hardening: fix timing attacks, plugin loading vulnerabilities, and input validation bypasses #384