It seems backwards to worry about attacks when basic functionality is undocumented/broken.