even if we're returning a safe string, use a format in snprintf calls