Isn't there a `safe_load` or something we're supposed to be using since that security bug a few months back?