Certain types of attachments to BPM tasks and processes are recognized by the browser and automatically executed upon download, e.g. javascript files. This creates a potential risk of executing malicious active content. Since BPM as a platform is not intended for use with open user goups (i.e. anonymous users) the risk is rated low.