Note insecurity of stb_sprintf