During security review we were asked to make sure our C++ compile flags for Release configs use the following:

Compile-time flags: -O2 -D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIE -Wa,--noexecstack -Wformat -Wformat-security
Link-time flags: -pie -Wl,-z,relro,-z,now

This is non-urgent, but we should address for 1.0.

FYI @abarth @chinmaygarde