A short list of useful hardening features that make a serious difference for Graphene: Zero-on-free with detection of write-after-free via checking that memory is still zeroed before handing it out again.

GitHub

GitHub - GrapheneOS/hardened_malloc: Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as...

Turn USB-C to power only (no data) when screen is locked. Auto reboot after X hours. Turn off WiFi/Bluetooth after X minutes after disconnect. Hardened kernal. Strong commitment to fast updates of drivers, kernal and OS to security patch level. Dynamic code loading blocked. More here:

Features overview | GrapheneOS

Thanks!