🔒 [security fix] Unsafe set_len without size validation in api.rs

🔒 [security fix] Unsafe set_len without size validation in api.rs #427