jfryman/puppet-znc — pull request #8 by oholiab (2014-11-27 13:01:08+00:00)
Title: Remove dangerous defaults

This defaults the admin user's username, password and channels to undef, and then validates them to their respective types thus breaking the dangerous hidden default behaviour of creating a known admin user which joins a known channel, which could easily be exploited by watching the default channel on freenode and then using the default credentials on the originating IP.
The admin user now *has* to be manually specified.