exclude config for security