security notes for subprocesshelper.py