A big thing missing is swapping out dependencies in unsafe languages for ones written in safe languages. Usually there are only a couple places that actually d

A big thing missing is swapping out dependencies in unsafe languages for ones written in safe languages. Usually there are only a couple places that actually deal with user controlled data, so switching to safe dependencies for things like making thumbnails for pdf files can be effective. Edit: One more thing is compiling unsafe code to web assembly or other forms of sandboxing it was not mentioned.