security/core#2 Harden some of the "mode" inputs