OP is also deploying on openbsd. With pledge(), they can easily lock down the cgi in terms of syscalls it can make and files it can see.