diff --git a/include/neuron/define.h b/include/neuron/define.h
index 916454c3..7c3b71af 100644
--- a/include/neuron/define.h
+++ b/include/neuron/define.h
@@ -96,6 +96,9 @@
 #define NEU_CID_LEN32 32
 #define NEU_CID_LEN64 64
 
+#define NEU_TRACE_ID_LEN 64
+#define NEU_SPAN_ID_LEN 32
+
 #define CHECK_NODE_NAME_LENGTH_ERR                                            \
     do {                                                                      \
         NEU_JSON_RESPONSE_ERROR(NEU_ERR_NODE_NAME_TOO_LONG, {                 \
diff --git a/include/neuron/metrics.h b/include/neuron/metrics.h
index 7c312860..032b95d6 100644
--- a/include/neuron/metrics.h
+++ b/include/neuron/metrics.h
@@ -286,8 +286,8 @@ typedef struct {
 
 typedef struct {
     char                distro[32];
-    char                kernel[32];
-    char                machine[32];
+    char                kernel[80];
+    char                machine[80];
     char                clib[32];
     char                clib_version[32];
     unsigned            cpu_percent;
diff --git a/include/neuron/msg.h b/include/neuron/msg.h
index 6551e5e6..44ba020b 100644
--- a/include/neuron/msg.h
+++ b/include/neuron/msg.h
@@ -654,8 +654,8 @@ static inline void neu_req_add_tag_fini(neu_req_add_tag_t *req)
 static inline int neu_req_add_tag_copy(neu_req_add_tag_t *dst,
                                        neu_req_add_tag_t *src)
 {
-    strcpy(dst->driver, src->driver);
-    strcpy(dst->group, src->group);
+    strncpy(dst->driver, src->driver, NEU_NODE_NAME_LEN - 1);
+    strncpy(dst->group, src->group, NEU_GROUP_NAME_LEN - 1);
     dst->tags = (neu_datatag_t *) calloc(src->n_tag, sizeof(src->tags[0]));
     if (NULL == dst->tags) {
         return -1;
@@ -690,8 +690,8 @@ static inline void neu_req_del_tag_fini(neu_req_del_tag_t *req)
 static inline int neu_req_del_tag_copy(neu_req_del_tag_t *dst,
                                        neu_req_del_tag_t *src)
 {
-    strcpy(dst->driver, src->driver);
-    strcpy(dst->group, src->group);
+    strncpy(dst->driver, src->driver, NEU_NODE_NAME_LEN - 1);
+    strncpy(dst->group, src->group, NEU_GROUP_NAME_LEN - 1);
     dst->tags = (char **) calloc(src->n_tag, sizeof(src->tags[0]));
     if (NULL == dst->tags) {
         return -1;
@@ -835,7 +835,7 @@ static inline void neu_req_node_setting_fini(neu_req_node_setting_t *req)
 static inline int neu_req_node_setting_copy(neu_req_node_setting_t *dst,
                                             neu_req_node_setting_t *src)
 {
-    strcpy(dst->node, src->node);
+    strncpy(dst->node, src->node, NEU_NODE_NAME_LEN - 1);
     dst->setting = strdup(src->setting);
     return dst->setting ? 0 : -1;
 }
@@ -1659,13 +1659,13 @@ inline static void neu_msg_exchange(neu_reqresp_head_t *header)
 {
     char tmp[NEU_NODE_NAME_LEN] = { 0 };
 
-    strcpy(tmp, header->sender);
+    strncpy(tmp, header->sender, sizeof(tmp) - 1);
 
     memset(header->sender, 0, sizeof(header->sender));
-    strcpy(header->sender, header->receiver);
+    strncpy(header->sender, header->receiver, sizeof(header->sender) - 1);
 
     memset(header->receiver, 0, sizeof(header->receiver));
-    strcpy(header->receiver, tmp);
+    strncpy(header->receiver, tmp, sizeof(header->receiver) - 1);
 }
 
 typedef struct {
diff --git a/include/neuron/utils/uthash.h b/include/neuron/utils/uthash.h
index 49c69df0..309a03aa 100644
--- a/include/neuron/utils/uthash.h
+++ b/include/neuron/utils/uthash.h
@@ -513,7 +513,7 @@ do {
  */
 #ifdef HASH_DEBUG
 #include <stdio.h>   /* fprintf, stderr */
-#define HASH_OOPS(...) do { fprintf(stderr, __VA_ARGS__); exit(-1); } while (0)
+#define HASH_OOPS(...) do { fprintf(stderr, "%s", __VA_ARGS__); exit(-1); } while (0)
 #define HASH_FSCK(hh,head,where)                                                 \
 do {                                                                             \
   struct UT_hash_handle *_thh;                                                   \
diff --git a/neuron.json b/neuron.json
index 79621cb7..f04e63fd 100644
--- a/neuron.json
+++ b/neuron.json
@@ -1,8 +1,8 @@
 {
-	"ip": "0.0.0.0",
+	"ip": "127.0.0.1",
 	"port": 7000,
 	"disable_auth": 0,
 	"syslog_host": "",
 	"syslog_port": 541,
 	"sub_filter_error": 0
-}
+}
\ No newline at end of file
diff --git a/plugins/ekuiper/read_write.c b/plugins/ekuiper/read_write.c
index ed64d5a5..87943c15 100644
--- a/plugins/ekuiper/read_write.c
+++ b/plugins/ekuiper/read_write.c
@@ -327,7 +327,7 @@ static int send_write_tag_req(neu_plugin_t *plugin, neu_json_write_req_t *req,
         header.ctx             = calloc(1, 48 + strlen(playload) + 1);
         binary_to_hex(trace_id, 16, header.ctx);
         binary_to_hex(span_id, 8, header.ctx + 32);
-        strcpy(header.ctx + 48, playload);
+        strncpy(header.ctx + 48, playload, strlen(playload));
     }
 
     neu_req_write_tag_t cmd = {
@@ -374,7 +374,7 @@ static int send_write_tags_req(neu_plugin_t *             plugin,
         header.ctx             = calloc(1, 48 + strlen(playload) + 1);
         binary_to_hex(trace_id, 16, header.ctx);
         binary_to_hex(span_id, 8, header.ctx + 32);
-        strcpy(header.ctx + 48, playload);
+        strncpy(header.ctx + 48, playload, strlen(playload));
     }
 
     neu_req_write_tags_t cmd = { 0 };
@@ -387,7 +387,7 @@ static int send_write_tags_req(neu_plugin_t *             plugin,
     }
 
     for (int i = 0; i < cmd.n_tag; i++) {
-        strcpy(cmd.tags[i].tag, req->tags[i].tag);
+        strncpy(cmd.tags[i].tag, req->tags[i].tag, NEU_TAG_NAME_LEN - 1);
         if (0 !=
             json_value_to_tag_value(&req->tags[i].value, req->tags[i].t,
                                     &cmd.tags[i].value)) {
diff --git a/plugins/mqtt/schema.c b/plugins/mqtt/schema.c
index e67f0189..69458560 100644
--- a/plugins/mqtt/schema.c
+++ b/plugins/mqtt/schema.c
@@ -24,7 +24,7 @@ static int mqtt_schema_parse(json_t *root, mqtt_schema_vt_t **vts,
             mqtt_schema_vt_t *vt = &(*vts)[*vts_len - 1];
 
             memset(vt, 0, sizeof(mqtt_schema_vt_t));
-            strcpy(vt->name, key);
+            strncpy(vt->name, key, sizeof(vt->name) - 1);
 
             if (strcmp(str_val, "${timestamp}") == 0) {
                 vt->vt = MQTT_SCHEMA_TIMESTAMP;
@@ -50,7 +50,7 @@ static int mqtt_schema_parse(json_t *root, mqtt_schema_vt_t **vts,
                     return -1;
                 } else {
                     vt->vt = MQTT_SCHEMA_UD;
-                    strcpy(vt->ud, str_val);
+                    strncpy(vt->ud, str_val, sizeof(vt->ud) - 1);
                 }
             }
         } else if (json_is_object(value)) {
@@ -63,7 +63,7 @@ static int mqtt_schema_parse(json_t *root, mqtt_schema_vt_t **vts,
             mqtt_schema_vt_t *vt = &(*vts)[*vts_len - 1];
 
             memset(vt, 0, sizeof(mqtt_schema_vt_t));
-            strcpy(vt->name, key);
+            strncpy(vt->name, key, sizeof(vt->name) - 1);
 
             vt->vt = MQTT_SCHEMA_OBJECT;
             return mqtt_schema_parse(value, &vt->sub_vts, &vt->n_sub_vts,
@@ -338,7 +338,7 @@ int mqtt_static_validate(const char *static_tags, mqtt_static_vt_t **vts,
         mqtt_static_vt_t *vt = &(*vts)[*vts_len - 1];
 
         memset(vt, 0, sizeof(mqtt_static_vt_t));
-        strcpy(vt->name, key);
+        strncpy(vt->name, key, sizeof(vt->name) - 1);
 
         if (json_is_string(value)) {
             vt->jtype          = NEU_JSON_STR;
diff --git a/plugins/restful/adapter_handle.c b/plugins/restful/adapter_handle.c
index 0de2d3f3..87babfd5 100644
--- a/plugins/restful/adapter_handle.c
+++ b/plugins/restful/adapter_handle.c
@@ -56,8 +56,8 @@ void handle_add_adapter(nng_aio *aio)
 
                 header.ctx  = aio;
                 header.type = NEU_REQ_ADD_NODE;
-                strcpy(cmd.node, req->name);
-                strcpy(cmd.plugin, req->plugin);
+                strncpy(cmd.node, req->name, NEU_NODE_NAME_LEN - 1);
+                strncpy(cmd.plugin, req->plugin, NEU_PLUGIN_NAME_LEN - 1);
                 cmd.setting  = req->setting;
                 req->setting = NULL; // moved
                 ret          = neu_plugin_op(plugin, header, &cmd);
@@ -96,8 +96,8 @@ static inline int send_node_update_req(nng_aio *                   aio,
     }
 
     neu_req_update_node_t cmd = { 0 };
-    strcpy(cmd.node, req->name);
-    strcpy(cmd.new_name, req->new_name);
+    strncpy(cmd.node, req->name, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.new_name, req->new_name, NEU_NODE_NAME_LEN - 1);
 
     neu_reqresp_head_t header = {
         .ctx             = aio,
@@ -140,7 +140,7 @@ void handle_del_adapter(nng_aio *aio)
 
                 header.ctx  = aio;
                 header.type = NEU_REQ_DEL_NODE;
-                strcpy(cmd.node, req->name);
+                strncpy(cmd.node, req->name, NEU_NODE_NAME_LEN - 1);
                 ret = neu_plugin_op(plugin, header, &cmd);
                 if (ret != 0) {
                     NEU_JSON_RESPONSE_ERROR(NEU_ERR_IS_BUSY, {
@@ -178,16 +178,16 @@ void handle_get_adapter(nng_aio *aio)
 
     if (neu_http_get_param_str(aio, "plugin", plugin_name,
                                sizeof(plugin_name)) > 0) {
-        strcpy(cmd.plugin, plugin_name);
+        strncpy(cmd.plugin, plugin_name, NEU_PLUGIN_NAME_LEN - 1);
     }
 
     if (neu_http_get_param_str(aio, "node", node_name, sizeof(node_name)) > 0) {
-        strcpy(cmd.node, node_name);
+        strncpy(cmd.node, node_name, NEU_NODE_NAME_LEN - 1);
     }
 
     if (neu_http_get_param_str(aio, "group", group_name, sizeof(group_name)) >
         0) {
-        strcpy(cmd.query.q_group_name, group_name);
+        strncpy(cmd.query.q_group_name, group_name, NEU_GROUP_NAME_LEN - 1);
     }
 
     uintmax_t query_state = 0;
@@ -265,7 +265,7 @@ void handle_set_node_setting(nng_aio *aio)
 
                 header.ctx  = aio;
                 header.type = NEU_REQ_NODE_SETTING;
-                strcpy(cmd.node, req->node);
+                strncpy(cmd.node, req->node, NEU_NODE_NAME_LEN - 1);
                 cmd.setting  = req->setting;
                 req->setting = NULL; // ownership moved
                 ret          = neu_plugin_op(plugin, header, &cmd);
@@ -299,7 +299,7 @@ void handle_get_node_setting(nng_aio *aio)
     header.ctx             = aio;
     header.type            = NEU_REQ_GET_NODE_SETTING;
     header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM;
-    strcpy(cmd.node, node_name);
+    strncpy(cmd.node, node_name, NEU_NODE_NAME_LEN - 1);
 
     ret = neu_plugin_op(plugin, header, &cmd);
     if (ret != 0) {
@@ -348,7 +348,7 @@ void handle_node_ctl(nng_aio *aio)
 
                 header.ctx  = aio;
                 header.type = NEU_REQ_NODE_CTL;
-                strcpy(cmd.node, req->node);
+                strncpy(cmd.node, req->node, NEU_NODE_NAME_LEN - 1);
                 cmd.ctl = req->cmd;
 
                 ret = neu_plugin_op(plugin, header, &cmd);
@@ -379,7 +379,7 @@ void handle_get_node_state(nng_aio *aio)
         header.type = NEU_REQ_GET_NODES_STATE;
     } else {
         header.type = NEU_REQ_GET_NODE_STATE;
-        strcpy(cmd.node, node_name);
+        strncpy(cmd.node, node_name, NEU_NODE_NAME_LEN - 1);
     }
 
     ret = neu_plugin_op(plugin, header, &cmd);
@@ -453,7 +453,8 @@ static int json_to_gdatatags(neu_json_gtag_array_t *gtag_array,
     }
 
     for (int i = 0; i < gtag_array->len; i++) {
-        strcpy(gdatatags[i].group, gtag_array->gtags[i].group);
+        strncpy(gdatatags[i].group, gtag_array->gtags[i].group,
+                NEU_GROUP_NAME_LEN - 1);
         gdatatags[i].n_tag    = gtag_array->gtags[i].n_tag;
         gdatatags[i].interval = gtag_array->gtags[i].interval;
         gdatatags[i].tags =
diff --git a/plugins/restful/datatag_handle.c b/plugins/restful/datatag_handle.c
index 574ab283..d03f7776 100644
--- a/plugins/restful/datatag_handle.c
+++ b/plugins/restful/datatag_handle.c
@@ -76,8 +76,8 @@ void handle_add_tags(nng_aio *aio)
                 } else {
                     header.ctx  = aio;
                     header.type = NEU_REQ_ADD_TAG;
-                    strcpy(cmd.driver, req->node);
-                    strcpy(cmd.group, req->group);
+                    strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
+                    strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
                     cmd.n_tag = req->n_tag;
                     cmd.tags  = calloc(req->n_tag, sizeof(neu_datatag_t));
 
@@ -184,12 +184,13 @@ void handle_add_gtags(nng_aio *aio)
             if (add_resp.error > 0) {
                 handle_add_tags_resp(aio, &add_resp);
             } else {
-                strcpy(cmd.driver, req->node);
+                strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
                 cmd.n_group = req->n_group;
                 cmd.groups  = calloc(req->n_group, sizeof(neu_gdatatag_t));
 
                 for (int i = 0; i < req->n_group; i++) {
-                    strcpy(cmd.groups[i].group, req->groups[i].group);
+                    strncpy(cmd.groups[i].group, req->groups[i].group,
+                            NEU_GROUP_NAME_LEN - 1);
                     cmd.groups[i].n_tag    = req->groups[i].n_tag;
                     cmd.groups[i].interval = req->groups[i].interval;
                     cmd.groups[i].tags =
@@ -267,7 +268,7 @@ void handle_import_tags(nng_aio *aio)
                 header.type            = NEU_REQ_IMPORT_TAGS;
                 header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM;
 
-                strcpy(cmd.node, req->node);
+                strncpy(cmd.node, req->node, NEU_NODE_NAME_LEN - 1);
 
                 int ret = neu_plugin_op(plugin, header, &cmd);
                 if (ret != 0) {
@@ -318,8 +319,8 @@ void handle_del_tags(nng_aio *aio)
                 goto error;
             }
 
-            strcpy(cmd.driver, req->node);
-            strcpy(cmd.group, req->group);
+            strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
+            strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
             cmd.n_tag = req->n_tags;
 
             for (int i = 0; i < req->n_tags; i++) {
@@ -364,8 +365,8 @@ void handle_update_tags(nng_aio *aio)
             header.type            = NEU_REQ_UPDATE_TAG;
             header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM;
 
-            strcpy(cmd.driver, req->node);
-            strcpy(cmd.group, req->group);
+            strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
+            strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
             cmd.n_tag = req->n_tag;
             cmd.tags  = calloc(req->n_tag, sizeof(neu_datatag_t));
 
@@ -428,11 +429,11 @@ void handle_get_tags(nng_aio *aio)
     }
 
     if (neu_http_get_param_str(aio, "name", tag_name, sizeof(tag_name)) >= 0) {
-        strcpy(cmd.name, tag_name);
+        strncpy(cmd.name, tag_name, NEU_TAG_NAME_LEN - 1);
     }
 
-    strcpy(cmd.driver, node);
-    strcpy(cmd.group, group);
+    strncpy(cmd.driver, node, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, group, NEU_GROUP_NAME_LEN - 1);
 
     ret = neu_plugin_op(plugin, header, &cmd);
     if (ret != 0) {
diff --git a/plugins/restful/global_config_handle.c b/plugins/restful/global_config_handle.c
index 534ef807..5eb2d5e7 100644
--- a/plugins/restful/global_config_handle.c
+++ b/plugins/restful/global_config_handle.c
@@ -771,8 +771,8 @@ static int get_tags(context_t *ctx, neu_resp_driver_group_info_t *info)
     };
 
     neu_req_get_tag_t cmd = { 0 };
-    strcpy(cmd.driver, info->driver);
-    strcpy(cmd.group, info->group);
+    strncpy(cmd.driver, info->driver, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, info->group, NEU_GROUP_NAME_LEN - 1);
 
     if (0 != neu_plugin_op(plugin, header, &cmd)) {
         rv = NEU_ERR_IS_BUSY;
@@ -925,7 +925,7 @@ static int get_subscriptions(context_t *ctx, neu_resp_node_info_t *info)
     };
 
     neu_req_get_subscribe_group_t cmd = { 0 };
-    strcpy(cmd.app, info->node);
+    strncpy(cmd.app, info->node, NEU_NODE_NAME_LEN - 1);
 
     if (0 != neu_plugin_op(plugin, header, &cmd)) {
         return NEU_ERR_IS_BUSY;
@@ -1009,7 +1009,7 @@ static int get_setting(context_t *ctx, neu_resp_node_info_t *info)
     };
 
     neu_req_get_node_setting_t cmd = { 0 };
-    strcpy(cmd.node, info->node);
+    strncpy(cmd.node, info->node, NEU_NODE_NAME_LEN - 1);
 
     if (0 != neu_plugin_op(plugin, header, &cmd)) {
         return NEU_ERR_IS_BUSY;
@@ -1089,7 +1089,7 @@ static int del_node(context_t *ctx, neu_resp_node_info_t *info)
     };
 
     neu_req_del_node_t cmd = { 0 };
-    strcpy(cmd.node, info->node);
+    strncpy(cmd.node, info->node, NEU_NODE_NAME_LEN - 1);
 
     if (0 != neu_plugin_op(plugin, header, &cmd)) {
         return NEU_ERR_IS_BUSY;
@@ -1109,8 +1109,8 @@ static int add_node(context_t *ctx, neu_json_get_nodes_resp_node_t *req)
     };
 
     neu_req_add_node_t cmd = { 0 };
-    strcpy(cmd.node, req->name);
-    strcpy(cmd.plugin, req->plugin);
+    strncpy(cmd.node, req->name, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.plugin, req->plugin, NEU_PLUGIN_NAME_LEN - 1);
 
     if (0 != neu_plugin_op(plugin, header, &cmd)) {
         return NEU_ERR_IS_BUSY;
@@ -1131,8 +1131,8 @@ static int add_group(context_t *                             ctx,
     };
 
     neu_req_add_group_t cmd = { 0 };
-    strcpy(cmd.driver, data->driver);
-    strcpy(cmd.group, data->group);
+    strncpy(cmd.driver, data->driver, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, data->group, NEU_GROUP_NAME_LEN - 1);
     cmd.interval = data->interval;
 
     if (0 != neu_plugin_op(plugin, header, &cmd)) {
@@ -1154,8 +1154,8 @@ static int add_tag(context_t *ctx, neu_json_add_tags_req_t *data)
     };
 
     neu_req_add_tag_t cmd = { 0 };
-    strcpy(cmd.driver, data->node);
-    strcpy(cmd.group, data->group);
+    strncpy(cmd.driver, data->node, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, data->group, NEU_GROUP_NAME_LEN - 1);
     cmd.n_tag = data->n_tag;
     cmd.tags  = calloc(data->n_tag, sizeof(neu_datatag_t));
     if (NULL == cmd.tags) {
@@ -1207,9 +1207,9 @@ static int add_subscription(context_t *ctx, neu_json_subscribe_req_t *data)
     };
 
     neu_req_subscribe_t cmd = { 0 };
-    strcpy(cmd.app, data->app);
-    strcpy(cmd.driver, data->driver);
-    strcpy(cmd.group, data->group);
+    strncpy(cmd.app, data->app, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.driver, data->driver, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, data->group, NEU_GROUP_NAME_LEN - 1);
     cmd.params   = data->params; // ownership moved
     data->params = NULL;
 
@@ -1231,7 +1231,7 @@ static int add_setting(context_t *ctx, neu_json_node_setting_req_t *data)
     };
 
     neu_req_node_setting_t cmd = { 0 };
-    strcpy(cmd.node, data->node);
+    strncpy(cmd.node, data->node, NEU_NODE_NAME_LEN - 1);
     cmd.setting   = data->setting; // ownership moved
     data->setting = NULL;
 
diff --git a/plugins/restful/group_config_handle.c b/plugins/restful/group_config_handle.c
index 00b66880..82bbb659 100644
--- a/plugins/restful/group_config_handle.c
+++ b/plugins/restful/group_config_handle.c
@@ -48,8 +48,8 @@ void handle_add_group_config(nng_aio *aio)
                 header.ctx                 = aio;
                 header.type                = NEU_REQ_ADD_GROUP;
                 header.otel_trace_type     = NEU_OTEL_TRACE_TYPE_REST_COMM;
-                strcpy(cmd.driver, req->node);
-                strcpy(cmd.group, req->group);
+                strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
+                strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
                 cmd.interval = req->interval;
                 ret          = neu_plugin_op(plugin, header, &cmd);
                 if (ret != 0) {
@@ -92,14 +92,14 @@ static inline int send_update_group(nng_aio *                           aio,
         } else if (len >= NEU_GROUP_NAME_LEN) {
             return NEU_ERR_GROUP_NAME_TOO_LONG;
         }
-        strcpy(cmd.new_name, req->new_name);
+        strncpy(cmd.new_name, req->new_name, NEU_GROUP_NAME_LEN - 1);
     } else {
         // if `new_name` is omitted, then keep the node name
-        strcpy(cmd.new_name, req->group);
+        strncpy(cmd.new_name, req->group, NEU_GROUP_NAME_LEN - 1);
     }
 
-    strcpy(cmd.driver, req->node);
-    strcpy(cmd.group, req->group);
+    strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
     cmd.interval = req->set_interval ? req->interval : 0;
 
     neu_reqresp_head_t header = {
@@ -146,8 +146,8 @@ void handle_del_group_config(nng_aio *aio)
                 header.ctx             = aio;
                 header.type            = NEU_REQ_DEL_GROUP;
                 header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM;
-                strcpy(cmd.driver, req->node);
-                strcpy(cmd.group, req->group);
+                strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
+                strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
                 ret = neu_plugin_op(plugin, header, &cmd);
                 if (ret != 0) {
                     NEU_JSON_RESPONSE_ERROR(NEU_ERR_IS_BUSY, {
@@ -174,14 +174,14 @@ void handle_get_group_config(nng_aio *aio)
     NEU_VALIDATE_JWT(aio);
 
     neu_http_get_param_str(aio, "node", node_name, sizeof(node_name));
-    strcpy(cmd.driver, node_name);
+    strncpy(cmd.driver, node_name, NEU_NODE_NAME_LEN - 1);
     if (strlen(cmd.driver) == 0) {
         header.type = NEU_REQ_GET_DRIVER_GROUP;
     }
 
     if (neu_http_get_param_str(aio, "group", group_name, sizeof(group_name)) >
         0) {
-        strcpy(cmd.q_group, group_name);
+        strncpy(cmd.q_group, group_name, NEU_GROUP_NAME_LEN - 1);
     }
 
     ret = neu_plugin_op(plugin, header, &cmd);
@@ -273,9 +273,9 @@ static inline int send_subscribe(nng_aio *aio, neu_reqresp_type_e type,
     }
 
     neu_req_subscribe_t cmd = { 0 };
-    strcpy(cmd.app, req->app);
-    strcpy(cmd.driver, req->driver);
-    strcpy(cmd.group, req->group);
+    strncpy(cmd.app, req->app, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.driver, req->driver, NEU_NODE_NAME_LEN - 1);
+    strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
     cmd.params       = req->params;      // ownership moved
     cmd.static_tags  = req->static_tags; // ownership moved
     req->params      = NULL;
@@ -340,9 +340,9 @@ void handle_grp_unsubscribe(nng_aio *aio)
                 goto error;
             }
 
-            strcpy(cmd.app, req->app);
-            strcpy(cmd.driver, req->driver);
-            strcpy(cmd.group, req->group);
+            strncpy(cmd.app, req->app, NEU_NODE_NAME_LEN - 1);
+            strncpy(cmd.driver, req->driver, NEU_NODE_NAME_LEN - 1);
+            strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
             ret = neu_plugin_op(plugin, header, &cmd);
             if (ret != 0) {
                 NEU_JSON_RESPONSE_ERROR(NEU_ERR_IS_BUSY, {
diff --git a/plugins/restful/log_handle.c b/plugins/restful/log_handle.c
index 61347812..ff629300 100644
--- a/plugins/restful/log_handle.c
+++ b/plugins/restful/log_handle.c
@@ -90,7 +90,8 @@ void handle_log_level(nng_aio *aio)
                     cmd.core               = req->core;
                     cmd.log_level          = log_level;
                     if (req->node_name != NULL) {
-                        strcpy(cmd.node, req->node_name);
+                        strncpy(cmd.node, req->node_name,
+                                NEU_NODE_NAME_LEN - 1);
                     }
 
                     int ret = neu_plugin_op(plugin, header, &cmd);
diff --git a/plugins/restful/plugin_handle.c b/plugins/restful/plugin_handle.c
index 719e9361..65c8f9b1 100644
--- a/plugins/restful/plugin_handle.c
+++ b/plugins/restful/plugin_handle.c
@@ -91,7 +91,7 @@ void handle_del_plugin(nng_aio *aio)
             header.type            = NEU_REQ_DEL_PLUGIN;
             header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM;
             if (strlen(req->plugin) <= sizeof(cmd.plugin)) {
-                strcpy(cmd.plugin, req->plugin);
+                strncpy(cmd.plugin, req->plugin, NEU_PLUGIN_NAME_LEN - 1);
                 int ret = neu_plugin_op(plugin, header, &cmd);
                 if (ret != 0) {
                     NEU_JSON_RESPONSE_ERROR(NEU_ERR_IS_BUSY, {
diff --git a/plugins/restful/rw_handle.c b/plugins/restful/rw_handle.c
index 8f313de4..52ee222c 100644
--- a/plugins/restful/rw_handle.c
+++ b/plugins/restful/rw_handle.c
@@ -171,10 +171,10 @@ void handle_test_read_tag(nng_aio *aio)
                 goto error;
             }
 
-            strcpy(cmd.driver, req->driver);
-            strcpy(cmd.group, req->group);
-            strcpy(cmd.tag, req->tag);
-            strcpy(cmd.address, req->address);
+            strncpy(cmd.driver, req->driver, NEU_NODE_NAME_LEN - 1);
+            strncpy(cmd.group, req->group, NEU_GROUP_NAME_LEN - 1);
+            strncpy(cmd.tag, req->tag, NEU_TAG_NAME_LEN - 1);
+            strncpy(cmd.address, req->address, NEU_TAG_ADDRESS_LEN - 1);
             cmd.attribute = req->attribute;
             cmd.type      = req->type;
             cmd.precision = req->precision;
@@ -316,7 +316,8 @@ void handle_write(nng_aio *aio)
                 break;
             case NEU_JSON_STR:
                 cmd.value.type = NEU_TYPE_STRING;
-                strcpy(cmd.value.value.str, req->value.val_str);
+                strncpy(cmd.value.value.str, req->value.val_str,
+                        NEU_VALUE_SIZE);
                 break;
             case NEU_JSON_DOUBLE:
                 cmd.value.type      = NEU_TYPE_DOUBLE;
@@ -522,7 +523,8 @@ void handle_write_tags(nng_aio *aio)
             req->group = NULL; // ownership moved
 
             for (int i = 0; i < cmd.n_tag; i++) {
-                strcpy(cmd.tags[i].tag, req->tags[i].tag);
+                strncpy(cmd.tags[i].tag, req->tags[i].tag,
+                        NEU_TAG_NAME_LEN - 1);
                 switch (req->tags[i].t) {
                 case NEU_JSON_INT:
                     cmd.tags[i].value.type      = NEU_TYPE_INT64;
@@ -530,8 +532,8 @@ void handle_write_tags(nng_aio *aio)
                     break;
                 case NEU_JSON_STR:
                     cmd.tags[i].value.type = NEU_TYPE_STRING;
-                    strcpy(cmd.tags[i].value.value.str,
-                           req->tags[i].value.val_str);
+                    strncpy(cmd.tags[i].value.value.str,
+                            req->tags[i].value.val_str, NEU_VALUE_SIZE);
                     break;
                 case NEU_JSON_DOUBLE:
                     cmd.tags[i].value.type      = NEU_TYPE_DOUBLE;
@@ -650,7 +652,8 @@ static void trans(neu_json_write_gtags_req_t *req, neu_req_write_gtags_t *cmd)
             calloc(cmd->groups[i].n_tag, sizeof(neu_resp_tag_value_t));
 
         for (int k = 0; k < cmd->groups[i].n_tag; k++) {
-            strcpy(cmd->groups[i].tags[k].tag, req->groups[i].tags[k].tag);
+            strncpy(cmd->groups[i].tags[k].tag, req->groups[i].tags[k].tag,
+                    NEU_TAG_NAME_LEN - 1);
 
             switch (req->groups[i].tags[k].t) {
             case NEU_JSON_INT:
@@ -660,8 +663,8 @@ static void trans(neu_json_write_gtags_req_t *req, neu_req_write_gtags_t *cmd)
                 break;
             case NEU_JSON_STR:
                 cmd->groups[i].tags[k].value.type = NEU_TYPE_STRING;
-                strcpy(cmd->groups[i].tags[k].value.value.str,
-                       req->groups[i].tags[k].value.val_str);
+                strncpy(cmd->groups[i].tags[k].value.value.str,
+                        req->groups[i].tags[k].value.val_str, NEU_VALUE_SIZE);
                 break;
             case NEU_JSON_DOUBLE:
                 cmd->groups[i].tags[k].value.type = NEU_TYPE_DOUBLE;
diff --git a/plugins/restful/scan_handle.c b/plugins/restful/scan_handle.c
index 2d89315d..b8cd5346 100644
--- a/plugins/restful/scan_handle.c
+++ b/plugins/restful/scan_handle.c
@@ -43,15 +43,15 @@ void handle_scan_tags(nng_aio *aio)
             }
 
             if (NULL != req->node) {
-                strcpy(cmd.driver, req->node);
+                strncpy(cmd.driver, req->node, NEU_NODE_NAME_LEN - 1);
             }
 
             if (NULL != req->id) {
-                strcpy(cmd.id, req->id);
+                strncpy(cmd.id, req->id, NEU_TAG_ADDRESS_LEN - 1);
             }
 
             if (NULL != req->ctx) {
-                strcpy(cmd.ctx, req->ctx);
+                strncpy(cmd.ctx, req->ctx, NEU_VALUE_SIZE);
             }
 
             if (0 != neu_plugin_op(plugin, header, &cmd)) {