Always configure composer to allow drupal/core-vendor-hardening plugin as it might be left over in the cache