> It's solid security best practices to only install what you need, and leave the rest out. You are installing only what you need. And running it in the mode y

> It's solid security best practices to only install what you need, and leave the rest out. You are installing only what you need. And running it in the mode you suggested, client only, will lead to no philosophically different a state than a all new client that does the same thing. Once you set it running as a privileged user it cannot be modified by other users. It will have been tested in your environment and signed off by your infosec team if that isn't you. How is that different from any other piece of software that has options you should never use? Are you saying if your users use git that the 'bisect' command should be removed because they never need to use it?