* explicitly forbid flag deletion * breaking service through vuln is _not_ okay * in general rewrite from scratch, because we have too much that we do not actually want
