use deny-by-default security