[SECURITY] Explicitly deny object deserialization