security: add ESN soft limit in config