I agree that security stuff is best left to security researchers. However you need to draw the line somewhere. Allowing a while loop can be a security issue for

I agree that security stuff is best left to security researchers. However you need to draw the line somewhere. Allowing a while loop can be a security issue for some applications. I was more talking about issues like the `with` in JS or `goto` in other languages. Yeah, they are a really bad idea for the vast majority of situations, but every now and then they are incredibly useful or provide an insane speed improvement and they can be safely used. An eval example i've seen recently was about sending functions to web-workers. The only way to allow code to run in a web worker without a separate file is to convert a function to a string and eval the code in the web-worker side. So i could massively over complicate my build system, duplicate code in a bunch of places, and near-double the size of the downloaded code to get it working without eval, or i could setup a simple eval system and have it run a function passed in as a string. Yeah, you shouldn't be using eval to decide if the number entered was 5 or 6, but saying it's disallowed from the codebase entirely is silly. Even a policy like "any code that uses eval must be approved by X, Y, and Z before they will be allowed in the codebase" is much more sane.