Parser bugs are often a source of security vulnerabilities. A quick search reveals a torrent of BibTex CVEs [1]. Imagine writing a program than scanned through

Parser bugs are often a source of security vulnerabilities. A quick search reveals a torrent of BibTex CVEs [1]. Imagine writing a program than scanned through GitHub repos for citations in order to generate a bibliography. It'd downloading and parsing files created by a bunch of strangers on the internet. You'd want to be pretty confident in the parser you employed. Therefore, you should use a well maintained BibTex parser, but that's not an option in every language. For instance, the most popular Node JS library hasn't been updated in four years [2]. CFF allows you represent your citation as YAML, which is enormously popular and part of the toolchains of many projects. So, chances are that there is a YAML interpreter available in your language with active community behind it. As to your question as to how to inform visitors to repo of your citation file's format. The name of the file isn't have to be CITATION, it can be CITATION.cff. Alternately, you can have a CITATION.bib file. Github supports [3] this and you enjoy the same enhanced UI features. [1] https://www.cvedetails.com/google-search-results.php?q=yaml&sa=Search https://www.cvedetails.com/google-search-results.php?q=yaml&... [2] https://www.npmjs.com/search?q=bibtex&ranking=popularity https://www.npmjs.com/search?q=bibtex&ranking=popularity [3] https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-citation-files#other-citation-files https://docs.github.com/en/github/creating-cloning-and-archi...