http://maverick.i2p/blog/darknet-dev
Default credentials, exposed admin panels, verbose debug errors, unnecessary open ports, and unused services all widen attack surfaces. Systems must enforce least privilege across services, disable unused modules, and strip sensitive diagnostics from public responses.