I allway say it: it is the defaults, stupid (paraphrasign).

The Defaults have to be the most sensitive ones.

If you are a supposed super secure app, this should be the default.