diff --git a/modules/redis/client.ts b/modules/redis/client.ts
index d4eb35d..93a355d 100644
--- a/modules/redis/client.ts
+++ b/modules/redis/client.ts
@@ -98,9 +98,15 @@ export class RedisClient {
    * clears any prior rules so the call is idempotent, then the user is enabled with the given
    * password, confined to keys matching `<prefix>:*`, and allowed the ordinary command set. The
    * consumer connects as this user and can touch nothing outside its prefix.
+   *
+   * Minus the dangerous category: a key pattern confines commands that name keys, and FLUSHALL,
+   * FLUSHDB, CONFIG, SHUTDOWN and the rest of `@dangerous` name none — with `+@all` alone a
+   * consumer scoped to its own keys could still wipe the server (novox/hq issue 080). KEYS goes
+   * with them; SCAN stays, and is what a consumer should use anyway. INFO comes back: it is in the
+   * category, reads nothing a consumer keeps, and several client libraries ask it at connect.
    */
   async createAclUser(username: string, password: string, keyspacePrefix: string): Promise<void> {
-    await this.command("ACL", "SETUSER", username, "reset", "on", `>${password}`, `~${keyspacePrefix}:*`, "+@all");
+    await this.command("ACL", "SETUSER", username, "reset", "on", `>${password}`, `~${keyspacePrefix}:*`, "+@all", "-@dangerous", "+info");
   }
 
   async deleteAclUser(username: string): Promise<void> {