- more format-security workarounds