Disable `unsafe` by default

Close #147
Support mangling toplevel names

Close #127