diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 85e944f43..5e625415a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
       - name: autogen.sh
         run: ./autogen.sh
       - name: configure ${{ matrix.configure.label }}
-        run: ./configure --enable-assertions ${{ matrix.configure.opt }}
+        run: ./configure --enable-assertions ${{ matrix.configure.opt }} 'CFLAGS=-Werror=format-security'
       - uses: ammaraskar/gcc-problem-matcher@master
       - name: make
         run: make -j `nproc`
diff --git a/apache2/re.c b/apache2/re.c
index 82eba8f23..0a8b0724d 100644
--- a/apache2/re.c
+++ b/apache2/re.c
@@ -472,8 +472,8 @@ char *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *r
 
 end:
     if (my_error_msg) {
-        if (msr) msr_log(msr, 9, my_error_msg);
-        else ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, my_error_msg);
+        if (msr) msr_log(msr, 9, "%s", my_error_msg);
+        else ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, "%s", my_error_msg);
     }
     if (target_list != NULL) free(target_list);
     if (replace != NULL) free(replace);