Security won't be an issue here -- any YAML file that makes it into the repo has to go through a PR, and doesn't end up in gh-pages... but I'm happy to switch to `safe_load`.