I guess I'm being extra cautious here. Both [this gem](https://github.com/dtao/safe_yaml) and tenderlove's [psych](https://github.com/tenderlove/psych/issues/119) implement a `safe_load` alternative. Given that the Pipeline passes the rendered result to the framework, wouldn't it be too late by then to capture an exploit?