There is a new version (2.1) available at the URL http://siva.cshl.org/email/index.htm that does not have the security problem discussed here (tilde escapes). The problem went unfixed because it doesn't happen under SunOS, as those who attempted to demonstrate it to me presumably found out. Apologies for not having fixed it sooner. -T