diff --git a/Makefile b/Makefile
index 46e5632..958b0fb 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ VERSION-FILE: FORCE
 	@$(SHELL_PATH) ./GEN-VERSION-FILE
 -include VERSION-FILE
 
-CFLAGS = -g -O2 -Wall -W -std=gnu99
+CFLAGS = -g -O2 -Wall -W -std=gnu99 -Werror=format-security
 LDFLAGS =
 ALL_CFLAGS = $(CPPFLAGS) $(CFLAGS)
 ALL_LDFLAGS = $(LDFLAGS)
diff --git a/src/ipfilter.c b/src/ipfilter.c
index eb17ec7..8c76e4c 100644
--- a/src/ipfilter.c
+++ b/src/ipfilter.c
@@ -146,7 +146,7 @@ void gethostparams(struct hostparams *data, char *init_saddr, char *init_smask,
 				snprintf(msgstr, 60,
 					 "Invalid protocol input at or near token \"%s\"",
 					 bptr);
-				tui_error(ANYKEY_MSG, msgstr);
+				tui_error(ANYKEY_MSG, "%s", msgstr);
 				doagain = 1;
 			} else
 				doagain = 0;
diff --git a/src/othptab.c b/src/othptab.c
index 142c9c2..fe395c2 100644
--- a/src/othptab.c
+++ b/src/othptab.c
@@ -410,7 +410,7 @@ void printothpentry(struct othptable *table, struct othptabent *entry,
 				break;
 			}
 
-			sprintf(scratchpad, rarp_mac_addr);
+			sprintf(scratchpad, "%s", rarp_mac_addr);
 			strcat(msgstring, scratchpad);
 			wattrset(table->othpwin, ARPATTR);
 			break;
@@ -485,7 +485,7 @@ void printothpentry(struct othptable *table, struct othptabent *entry,
 		wattrset(table->othpwin, UNKNIPATTR);
 		protptr = getprotobynumber(entry->protocol);
 		if (protptr != NULL) {
-			sprintf(protname, protptr->p_aliases[0]);
+			sprintf(protname, "%s", protptr->p_aliases[0]);
 		} else {
 			sprintf(protname, "IP protocol");
 			unknown = 1;