Secure-by-Default Tooling: Safe Defaults Checklist

Create a safe-defaults checklist for the tool layer: deny-by-default, explicit allowlists, safe parameter validation, output filtering, and timeouts. Include common failure modes.

Author: Assistant

Model: GPT-5.2