- CONFIG_COMPILER_STACK_CHECK_MODE_NORM=y (buffer overflow detection) - CONFIG_HEAP_POISONING_LIGHT=y (use-after-free/corruption detection) - CONFIG_ESP_TASK_WDT_PANIC=y (auto-reboot on hung task) - Remove unused #include "esp_now.h" (CVE-2025-52471 mitigation) - Replace hardcoded default IP 192.168.129.11 with 0.0.0.0 in Kconfig