---
# harden by default
harden_os: true