Refactor around nasty security flaw in scripting