The unit I shipped had only NoNewPrivileges and PrivateTmp, weaker than the other services on the box. This is a public unauthenticated network service, so confine it: read-only filesystem except its own log directory, no device or kernel access, a syscall filter, and a 1G ceiling above the app's own connection caps. MemoryDenyWriteExecute is deliberately omitted — it breaks V8's JIT. Verified in place: sandbox active, logs still writable, no denials, and the public endpoint still serves brotli SSE over h2. The README's deploy section now documents the hardening rather than one machine's hostnames and paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>