In the current release, the Iterator class is missing a security declaration. ZPT 1.2, which I really hope to release by sometime tomorrow, has this fix. ZPT 1.2 will also have tal:repeat variables that match almost all of the dtml-in sequence-* variables, including 'odd', 'letter', and 'start'. Cheers, Evan @ digicool