diff --git a/src/apps/relay/dbdrivers/dbd_sqlite.c b/src/apps/relay/dbdrivers/dbd_sqlite.c
index 98d08484..7882e910 100644
--- a/src/apps/relay/dbdrivers/dbd_sqlite.c
+++ b/src/apps/relay/dbdrivers/dbd_sqlite.c
@@ -305,15 +305,15 @@ static int sqlite_get_oauth_key(const u08bits *kid, oauth_key_data_raw *key) {
 			int res = sqlite3_step(st);
 			if (res == SQLITE_ROW) {
 
-				STRCPY((char*)key->ikm_key,sqlite3_column_text(st, 0));
+				STRCPY(key->ikm_key,sqlite3_column_text(st, 0));
 				key->timestamp = (u64bits)strtoll((const char*)sqlite3_column_text(st, 1),NULL,10);
 				key->lifetime = (u32bits)strtol((const char*)sqlite3_column_text(st, 2),NULL,10);
-				STRCPY((char*)key->hkdf_hash_func,sqlite3_column_text(st, 3));
-				STRCPY((char*)key->as_rs_alg,sqlite3_column_text(st, 4));
-				STRCPY((char*)key->as_rs_key,sqlite3_column_text(st, 5));
-				STRCPY((char*)key->auth_alg,sqlite3_column_text(st, 6));
-				STRCPY((char*)key->auth_key,sqlite3_column_text(st, 7));
-				STRCPY((char*)key->kid,kid);
+				STRCPY(key->hkdf_hash_func,sqlite3_column_text(st, 3));
+				STRCPY(key->as_rs_alg,sqlite3_column_text(st, 4));
+				STRCPY(key->as_rs_key,sqlite3_column_text(st, 5));
+				STRCPY(key->auth_alg,sqlite3_column_text(st, 6));
+				STRCPY(key->auth_key,sqlite3_column_text(st, 7));
+				STRCPY(key->kid,kid);
 				ret = 0;
 			}
 		} else {
@@ -355,15 +355,15 @@ static int sqlite_list_oauth_keys(secrets_list_t *kids,secrets_list_t *hkdfs,sec
 				int res = sqlite3_step(st);
 				if (res == SQLITE_ROW) {
 
-					STRCPY((char*)key->ikm_key,sqlite3_column_text(st, 0));
+					STRCPY(key->ikm_key,sqlite3_column_text(st, 0));
 					key->timestamp = (u64bits)strtoll((const char*)sqlite3_column_text(st, 1),NULL,10);
 					key->lifetime = (u32bits)strtol((const char*)sqlite3_column_text(st, 2),NULL,10);
-					STRCPY((char*)key->hkdf_hash_func,sqlite3_column_text(st, 3));
-					STRCPY((char*)key->as_rs_alg,sqlite3_column_text(st, 4));
-					STRCPY((char*)key->as_rs_key,sqlite3_column_text(st, 5));
-					STRCPY((char*)key->auth_alg,sqlite3_column_text(st, 6));
-					STRCPY((char*)key->auth_key,sqlite3_column_text(st, 7));
-					STRCPY((char*)key->kid,sqlite3_column_text(st, 8));
+					STRCPY(key->hkdf_hash_func,sqlite3_column_text(st, 3));
+					STRCPY(key->as_rs_alg,sqlite3_column_text(st, 4));
+					STRCPY(key->as_rs_key,sqlite3_column_text(st, 5));
+					STRCPY(key->auth_alg,sqlite3_column_text(st, 6));
+					STRCPY(key->auth_key,sqlite3_column_text(st, 7));
+					STRCPY(key->kid,sqlite3_column_text(st, 8));
 
 					if(kids) {
 						add_to_secrets_list(kids,key->kid);
diff --git a/src/apps/relay/turn_admin_server.c b/src/apps/relay/turn_admin_server.c
index 7e4040c9..6bba4eb7 100644
--- a/src/apps/relay/turn_admin_server.c
+++ b/src/apps/relay/turn_admin_server.c
@@ -3355,7 +3355,7 @@ static void handle_https(ioa_socket_handle s, ioa_network_buffer_handle nbh)
 					const char *realm0 = get_http_header_value(hr, HR_REALM, current_realm());
 					if(!is_superuser())
 						realm0 = current_realm();
-					STRCPY(current_eff_realm(),realm0);
+					strncpy(current_eff_realm(),realm0,STUN_MAX_REALM_SIZE);
 					write_pc_page(s);
 				} else {
 					write_https_logon_page(s);
@@ -3367,7 +3367,7 @@ static void handle_https(ioa_socket_handle s, ioa_network_buffer_handle nbh)
 					const char *realm0 = get_http_header_value(hr, HR_REALM, current_realm());
 					if(!is_superuser())
 						realm0 = current_realm();
-					STRCPY(current_eff_realm(),realm0);
+					strncpy(current_eff_realm(),realm0,STUN_MAX_REALM_SIZE);
 
 					const char* client_protocol = get_http_header_value(hr, HR_CLIENT_PROTOCOL, "");
 
@@ -3402,7 +3402,7 @@ static void handle_https(ioa_socket_handle s, ioa_network_buffer_handle nbh)
 						const char *realm0 = get_http_header_value(hr, HR_REALM, current_realm());
 						if(!is_superuser())
 							realm0 = current_realm();
-						STRCPY(current_eff_realm(),realm0);
+						strncpy(current_eff_realm(),realm0,STUN_MAX_REALM_SIZE);
 					}
 
 					{
@@ -3502,7 +3502,7 @@ static void handle_https(ioa_socket_handle s, ioa_network_buffer_handle nbh)
 						const char *realm0 = get_http_header_value(hr, HR_REALM, current_realm());
 						if(!is_superuser())
 							realm0 = current_realm();
-						STRCPY(current_eff_realm(),realm0);
+						strncpy(current_eff_realm(),realm0,STUN_MAX_REALM_SIZE);
 					}
 
 					{
@@ -3575,7 +3575,7 @@ static void handle_https(ioa_socket_handle s, ioa_network_buffer_handle nbh)
 						const char *realm0 = get_http_header_value(hr, HR_REALM, current_realm());
 						if(!is_superuser())
 							realm0 = current_realm();
-						STRCPY(current_eff_realm(),realm0);
+						strncpy(current_eff_realm(),realm0,STUN_MAX_REALM_SIZE);
 					}
 
 					if(is_superuser()) {
@@ -3778,7 +3778,7 @@ static void handle_https(ioa_socket_handle s, ioa_network_buffer_handle nbh)
 			  const char *realm0 = get_http_header_value(hr, HR_REALM, current_realm());
 			  if(!is_superuser())
 			    realm0 = current_realm();
-			  STRCPY(current_eff_realm(),realm0);
+			  strncpy(current_eff_realm(),realm0,STUN_MAX_REALM_SIZE);
 			  write_https_home_page(s);
 			}
 			};