prevent forin and enforce locked down builtins