I built a site several years ago with CGI::Application which runs in cgi, not psgi mode. Is it likely to be vulnerable to the recent bash security hole which I understand revolves around setting ENV variables? gvim