Secure Defaults Review

Check that new services start with deny-by-default settings and minimal exposure.

• check
• security