The one-line config that blocks most smash-and-grab supply chain attacks