I completely agree with this. I use YAML as a way to write structured data that may be serialized into JSON at another endpoint (mostly because JSON is much more universal and what does it matter to me how exactly my data is serialized by another machine). I know of its other features but haven't found the need to try them, yet every security hole those features make possible ends up limiting the acceptance of YAML.