diff --git a/cli/src/main/java/run/endive/experimental/cli/Cli.java b/cli/src/main/java/run/endive/experimental/cli/Cli.java
index c0012cd13..0bde54104 100644
--- a/cli/src/main/java/run/endive/experimental/cli/Cli.java
+++ b/cli/src/main/java/run/endive/experimental/cli/Cli.java
@@ -62,7 +62,7 @@ public void run() {
                                         WasiPreview1.builder()
                                                 .withOptions(
                                                         WasiOptions.builder()
-                                                                .inheritSystem()
+                                                                .inheritSystemStreams()
                                                                 .build())
                                                 .build()
                                                 .toHostFunctions())
diff --git a/docs/docs/experimental/cli.md b/docs/docs/experimental/cli.md
index 968ecb7fb..df42749fa 100644
--- a/docs/docs/experimental/cli.md
+++ b/docs/docs/experimental/cli.md
@@ -6,7 +6,7 @@ title: CLI
 # Install and use the CLI
 
 :::warning[Security Consideration]
-The experimental CLI uses `inheritSystem()` by default, granting the Wasm module full access to the host filesystem, environment, and stdio. Do not use it with untrusted modules in its current form.
+The experimental CLI uses `inheritSystemStreams()` by default, granting the Wasm module access to stdin, stdout and stderr of the host. Do not use it with untrusted modules in its current form.
 :::
 
 The experimental Endive CLI is available for download on Maven at the link:
diff --git a/docs/docs/security/best-practices.md b/docs/docs/security/best-practices.md
index 269ffe73c..4b0d0c671 100644
--- a/docs/docs/security/best-practices.md
+++ b/docs/docs/security/best-practices.md
@@ -49,12 +49,13 @@ WASI file access does not enforce path sandboxing by default. Passing the host f
 var options = WasiOptions.builder()
         // Use ZeroFs to restrict access to specific directories
         .withDirectory("/guest/data", zeroFs.getPath("/host/sandboxed/data"))
-        .withStdout(myStdout)
-        .withStderr(myStderr)
         .build();
 ```
 
-**Never use `inheritSystem()` with untrusted modules** — it grants full host filesystem, environment, and stdio access.
+**Provide only access to what is needed by the Wasm module, especially if it is untrusted:**
+- Pass a virtual file system, and copy needed data to it in advance 
+- Pass only the needed environment variables and not all host environment variables
+- Inherit the host stdin, stdout and stderr only if needed; alternatively provide a custom `InputStream` and `OutputStream`
 
 ## Resource Limits
 
diff --git a/docs/docs/wasi/index.md b/docs/docs/wasi/index.md
index 12a209ea3..5499a5b91 100644
--- a/docs/docs/wasi/index.md
+++ b/docs/docs/wasi/index.md
@@ -147,7 +147,7 @@ var wasi = WasiOptions.builder().withStdout(System.out).withStderr(System.err).w
 a convenient shorthand for doing the same is:
 
 ```java
-var wasi = WasiOptions.builder().inheritSystem().build()
+var wasi = WasiOptions.builder().inheritSystemStreams().build()
 ```
 
 ## arguments
diff --git a/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java b/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java
index d143b8d6f..0808a8fec 100644
--- a/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java
+++ b/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java
@@ -24,7 +24,7 @@ public void shouldRunZigStdlibTestsuite() throws Exception {
 
             var wasiOpts =
                     WasiOptions.builder()
-                            .inheritSystem()
+                            .inheritSystemStreams()
                             .withArguments(List.of("test.wasm"))
                             .withDirectory(target.toString(), target)
                             .build();
diff --git a/wabt/src/main/java/run/endive/wabt/Wast2Json.java b/wabt/src/main/java/run/endive/wabt/Wast2Json.java
index 200261d3f..a81fbfb12 100644
--- a/wabt/src/main/java/run/endive/wabt/Wast2Json.java
+++ b/wabt/src/main/java/run/endive/wabt/Wast2Json.java
@@ -55,7 +55,7 @@ public void process() {
                                         .build())) {
 
             var wasiOpts = WasiOptions.builder();
-            wasiOpts.inheritSystem();
+            wasiOpts.inheritSystemStreams();
 
             Path inputFolder = fs.getPath("input");
             java.nio.file.Files.createDirectory(inputFolder);
diff --git a/wasi/src/main/java/run/endive/wasi/WasiOptions.java b/wasi/src/main/java/run/endive/wasi/WasiOptions.java
index f880b67be..007e12dbd 100644
--- a/wasi/src/main/java/run/endive/wasi/WasiOptions.java
+++ b/wasi/src/main/java/run/endive/wasi/WasiOptions.java
@@ -167,13 +167,25 @@ public Builder withStdin(InputStream stdin, boolean isTty) {
             return this;
         }
 
-        public Builder inheritSystem() {
+        /**
+         * Inherits {@code System.in}, {@code System.out} and {@code System.err}.
+         */
+        public Builder inheritSystemStreams() {
             this.stdout = System.out;
             this.stdin = System.in;
             this.stderr = System.err;
             return this;
         }
 
+        /**
+         * @deprecated renamed to {@link #inheritSystemStreams()}
+         */
+        @Deprecated
+        @SuppressWarnings("InlineMeSuggester")
+        public Builder inheritSystem() {
+            return inheritSystemStreams();
+        }
+
         public Builder withArguments(List<String> arguments) {
             this.arguments = List.copyOf(arguments);
             return this;
diff --git a/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java b/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java
index 4306503f3..7bcfbae8f 100644
--- a/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java
+++ b/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java
@@ -57,7 +57,7 @@ public void process() {
 
             var wasiOpts = WasiOptions.builder();
 
-            wasiOpts.inheritSystem();
+            wasiOpts.inheritSystemStreams();
 
             Path inputFolder = fs.getPath("input");
             java.nio.file.Files.createDirectory(inputFolder);