Gate exec writes on a sensitive default set, add disable + deny vars

Gate exec writes on a sensitive default set, add disable + deny vars #100