changed auto-format default to false, to prevent possible remote execution vulnerability