safe by default