@redconfetti thanks for setting this, @ctweney @raydavis we need to make sure we never set it to `*` for security reasons.