Patrick McElhaney

If you pass the context explicitly ( `mustache.render(template, context)` ) you should be able to avoid problem. (In theory, at least. I haven't tested. :))

Yes, that's a good catch. It's a drawback to extending Mustache.cfc instead of passing the context directly. Have you considered creating a component that doesn't extend Mustache and passing that...

Looks like you've solved the problem and didn't need to add any additional hooks to Mustache.cfc. :)

The render method doesn't fail. I copied your code and changed `"Hello, {{thing}}"` to `"Hello {{thing}} and {{init}}"`. The output was: ``` Hello, World and ! ``` If I actually...

No, I'm not expecting the Winner.mustache example to work. The first example from the readme (hello world), in which the context is passed to the render method, should work.

Yeah, I don't think anything can be done about views that extend Mustache.cfc paired with templates that could potentially contain "{{init}}". However, I'm scratching my head and wondering why that...

Okay, I get it now! Even if you pass a "clean" component to the render method, odds are that component will _at least_ have an init() method that you don't...

That's a possibility. I'm not completely sold on the blacklist though, now that I've given it some more thought. Aside from `init`, I'm not sure it should be Mustache's responsibility...

The exposure of the render, getPartials, and setPartials becomes a problem if two conditions are true: 1. The templates are created by users rather than developers. 2. The render() method...

Sure, we can add a warning to the documentation. I'd also like to make sure that by default, extending Mustache isn't really any more dangerous than passing a context to...