That's a good point. My assumption, not that I ever stated it, was that the list would be one you'd typed out yourself, or was one that was just there in code a

That's a good point. My assumption, not that I ever stated it, was that the list would be one you'd typed out yourself, or was one that was just there in code already, and you could verify by eye that it's just string literals. Using Python's eval with empty globals and locals dicts (consult the docs) could make this safer, though I've only ever had to use that for defending against accidents rather than malice. And now this quick thing is becoming increasingly complicated, and maybe you'd be better off engineering it properly.