All arbitrary Javascript is a "serious security risk" if you're reductive enough.