audit API surface for security

[jlevon]

Later on, when the API is firmer, we need to self-audit the code for robustness in the face of a malicious client (for example - no unconstrained allocations based on user-supplied values).