diff --git a/go/app/download.php b/go/app/download.php
index 91554bcb..5704ea9e 100644
--- a/go/app/download.php
+++ b/go/app/download.php
@@ -30,6 +30,12 @@ class AppDownloadPage {
     public static function redirect_to_file($url, $product, $version, $tier) {
       if(empty($url)) {
         JsonApiFailure::InvalidParameters("url");
+        return;
+      }
+
+      if(!preg_match("/^https?:\/\/downloads\\.keyman(-staging)?\\.com(\\.localhost)?\//", $url)) {
+        JsonApiFailure::Failure(400, JsonApiFailure::ERROR_InvalidParameters, "url parameter must start with downloads.keyman.com");
+        return;
       }
 
       if(empty($product)) {
diff --git a/go/package/download.php b/go/package/download.php
index c76f09d1..eca631cb 100644
--- a/go/package/download.php
+++ b/go/package/download.php
@@ -35,10 +35,12 @@ public static function redirect_to_file($type, $id, $version, $platform, $tier,
 
       if($type !== 'keyboard' && $type !== 'model') {
         JsonApiFailure::InvalidParameters("type");
+        return;
       }
 
       if(empty($id)) {
         JsonApiFailure::InvalidParameters("id, version");
+        return;
       }
 
       if(empty($version)) {
@@ -50,6 +52,7 @@ public static function redirect_to_file($type, $id, $version, $platform, $tier,
 
         if(empty($json)) {
           JsonApiFailure::Failure(404, JsonApiFailure::ERROR_NotFound, "$type package with id $id was not found");
+          return;
         }
 
         $version = $json->version;