things like superuser should be disabled by default (only DBA needs superuser access, not anybody else).