duck before 0.10 did not properly handle loading of untrusted code from the current directory.
{ "urgency": "not yet assigned" }