Hm... might be a BC break, but is a security issue, what do you think @yiisoft/core-developers ?