protect vendor and config