TAB: horrible insecure code