possible security fix: do not call slilog with intended message as format string