diff --git a/cdc-service/src/main/java/com/xtrmetl/cdc/config/XtrmetlProperties.java b/cdc-service/src/main/java/com/xtrmetl/cdc/config/XtrmetlProperties.java
index f0db1b9c..45533238 100644
--- a/cdc-service/src/main/java/com/xtrmetl/cdc/config/XtrmetlProperties.java
+++ b/cdc-service/src/main/java/com/xtrmetl/cdc/config/XtrmetlProperties.java
@@ -105,7 +105,11 @@ public static class Replica {
          */
         private String tables = "processed_data";
         private boolean ddlEnabled = false;
-        private String ddlValidationMode = "none";
+        /**
+         * Uses the positive allow-list policy unless an operator explicitly selects another
+         * supported mode. DDL application itself remains disabled by default.
+         */
+        private String ddlValidationMode = "whitelist";
         private String ddlAllowedPrefixes = "CREATE TABLE,ALTER TABLE,CREATE INDEX";
         private String ddlBlockedPrefixes = "DROP TABLE,DROP SCHEMA,DROP DATABASE,TRUNCATE";
         private final Kafka kafka = new Kafka();
diff --git a/cdc-service/src/test/java/com/xtrmetl/cdc/config/XtrmetlPropertiesSecurityDefaultTest.java b/cdc-service/src/test/java/com/xtrmetl/cdc/config/XtrmetlPropertiesSecurityDefaultTest.java
new file mode 100644
index 00000000..e7e3de4e
--- /dev/null
+++ b/cdc-service/src/test/java/com/xtrmetl/cdc/config/XtrmetlPropertiesSecurityDefaultTest.java
@@ -0,0 +1,21 @@
+package com.xtrmetl.cdc.config;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+class XtrmetlPropertiesSecurityDefaultTest {
+
+    @Test
+    void replicaDdlRemainsDisabledAndUsesWhitelistValidationByDefault() {
+        XtrmetlProperties properties = new XtrmetlProperties();
+
+        assertFalse(properties.getReplica().isDdlEnabled(), "DDL replication must remain disabled by default");
+        assertEquals(
+                "whitelist",
+                properties.getReplica().getDdlValidationMode(),
+                "the Java configuration object must match the deployable and metadata secure default"
+        );
+    }
+}