diff --git a/generate_tooltips.sh b/generate_tooltips.sh
index 33658a1..0c72380 100755
--- a/generate_tooltips.sh
+++ b/generate_tooltips.sh
@@ -40,8 +40,13 @@ const src = fs.readFileSync(process.env.RUNEWAGER_APP || 'index.js', 'utf8');
 // Execute just the DEFAULT_TIPS_LIST block and print it as JSON
 const m = src.match(/const DEFAULT_TIPS_LIST\s*=\s*(\[[\s\S]+?\]);/);
 if (!m) { process.stderr.write('DEFAULT_TIPS_LIST not found\n'); process.exit(1); }
+// Sanity-check the matched literal before evaluating (must look like an array)
+if (m[1].length > 500000 || !/^\s*\[/.test(m[1])) {
+  process.stderr.write('Unexpected DEFAULT_TIPS_LIST shape — aborting\n');
+  process.exit(1);
+}
 try {
-  // Use Function constructor for safe eval of the array literal
+  // Use Function constructor to evaluate the array literal in an isolated scope
   const list = (new Function('return ' + m[1]))();
   console.log(JSON.stringify(list, null, 2));
 } catch (e) { process.stderr.write('Parse error: ' + e.message + '\n'); process.exit(1); }
diff --git a/index.js b/index.js
index 62c1be6..fe962cc 100644
--- a/index.js
+++ b/index.js
@@ -4576,7 +4576,7 @@ function onboardingProgressBar(step) {
  * Prepends a progress bar header before the step-specific prompt.
  * @param {object} ctx - Telegraf context
  * @param {object} user - user state object
- * @param {number} step - current onboarding step (1–4)
+ * @param {number} step - current onboarding step (1–5)
  */
 async function showOnboardingPrompt(ctx, user, step) {
   // Send progress indicator (auto-deletes after 8s to keep chat clean)