Been running some tests against our Claw family endpoints and seeing different default behaviors right out of the gate. It got me thinking: with NemoClaw, NanoClaw, and IronClaw all having different runtime models, is there a consensus on a 'hardened' baseline config I can apply to any of them before I even start my specific threat modeling?

I'm not looking for marketing "secure by default" talk. I mean concrete settings for the API gateway or agent config that lock down the obvious stuff across the board. For example, I immediately throw this script at new agent endpoints to check for basic auth leaks:

```python
import requests
import sys

target = sys.argv[1]
headers_to_test = ['Authorization', 'X-API-Key', 'api-key']
for header in headers_to_test:
r = requests.get(f"{target}/status", headers={header: "test"})
if r.status_code != 401:
print(f"Potential issue with {header}: Got {r.status_code}")
```

I get different results depending on which Claw I'm pointing at. NanoClaw's lightweight runtime seems to pass through more by default. So before I dive into isolation models or credential handling deep-dives, I want to know if there's a standard set of gateway rules, network policies, or agent.yaml settings the community applies first to get a consistent security floor. Things like forcing all agent traffic over a specific internal interface, setting a universal rate limit rule, or disabling certain plugin modules.

What's your go-to config snippet you deploy immediately after installation, regardless of the specific Claw runtime?