Smarty

The comments imply that I shouldn't have to set secure_dir if I just want it to include the template_dir.

what kind of comments and where?

In Smarty.class.php, just above $secure_dir = array(), ...

It appears that template_exists($file) doesn't implicitly include template_dir in the
secure_dir array. It looks like _is_secure() is where this should be implemented
but isn't.

It's conceivable ...