diff --git a/.coverage b/.coverage
deleted file mode 100644
index 7ec3fd07..00000000
Binary files a/.coverage and /dev/null differ
diff --git a/trustgraph-base/trustgraph/i18n/__init__.py b/trustgraph-base/trustgraph/i18n/__init__.py
index 77674bf8..756738e8 100644
--- a/trustgraph-base/trustgraph/i18n/__init__.py
+++ b/trustgraph-base/trustgraph/i18n/__init__.py
@@ -98,11 +98,14 @@ def normalize_language(value: Optional[str]) -> str:
     return "en"
 
 
+# Returns a mutable object - caller must not mutate!
 @lru_cache(maxsize=32)
 def get_language_pack(language: str) -> Dict[str, str]:
     """Load the language pack for `language` from package resources."""
 
     lang = normalize_language(language)
+    if lang not in SUPPORTED_LANGUAGES:
+        lang = "en"
 
     try:
         with importlib_resources.open_text(
diff --git a/trustgraph-flow/trustgraph/gateway/endpoint/i18n.py b/trustgraph-flow/trustgraph/gateway/endpoint/i18n.py
index 67cd3c13..b949a499 100644
--- a/trustgraph-flow/trustgraph/gateway/endpoint/i18n.py
+++ b/trustgraph-flow/trustgraph/gateway/endpoint/i18n.py
@@ -40,6 +40,12 @@ class I18nPackEndpoint:
             return web.HTTPUnauthorized()
 
         lang = request.match_info.get("lang") or "en"
+
+        # This is a path traversal defense, and is a critical sec defense.
+        # Do not remove!
+        if "/" in lang or ".." in lang:
+            return web.HTTPBadRequest(reason="Invalid language code")
+
         pack = get_language_pack(lang)
 
         return web.json_response(pack)
diff --git a/trustgraph/trustgraph/trustgraph_version.py b/trustgraph/trustgraph/trustgraph_version.py
deleted file mode 100644
index b08ba8d4..00000000
--- a/trustgraph/trustgraph/trustgraph_version.py
+++ /dev/null
@@ -1 +0,0 @@
-__version__ = "2.2.999"