diff --git a/CMakeLists.txt b/CMakeLists.txt
index 18b1e8d..e311554 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,5 +1,6 @@
 cmake_minimum_required(VERSION 3.1)
 
+include(opus_buildtype.cmake)
 include(opus_functions.cmake)
 
 get_library_version(OPUS_LIBRARY_VERSION OPUS_LIBRARY_VERSION_MAJOR)
@@ -17,6 +18,11 @@
 
 project(Opus LANGUAGES C VERSION ${PROJECT_VERSION})
 
+option(OPUS_STACK_PROTECTOR "Use stack protection" ON)
+option(OPUS_USE_ALLOCA "Use alloca for stack arrays (on non-C99 compilers)" OFF)
+option(OPUS_CUSTOM_MODES "Enable non-Opus modes, e.g. 44.1 kHz & 2^n frames"
+       OFF)
+option(OPUS_BUILD_PROGRAMS "Build programs" OFF)
 option(OPUS_FIXED_POINT
        "Compile as fixed-point (for machines without a fast enough FPU)" OFF)
 option(OPUS_ENABLE_FLOAT_API
@@ -32,6 +38,16 @@
 include(CMakeDependentOption)
 include(FeatureSummary)
 
+if(OPUS_STACK_PROTECTOR)
+  if(NOT MSVC) # GC on by default on MSVC
+    check_and_set_flag(STACK_PROTECTION_STRONG -fstack-protector-strong)
+  endif()
+else()
+  if(MSVC)
+    check_and_set_flag(BUFFER_SECURITY_CHECK /GS-)
+  endif()
+endif()
+
 if(OPUS_CPU_X86 OR OPUS_CPU_X64)
   cmake_dependent_option(OPUS_X86_MAY_HAVE_SSE
                          "Does runtime check for SSE1 support"
@@ -100,6 +116,12 @@
                        PURPOSE
                        "required to set up package version")
 
+add_feature_info(STACK_PROTECTOR OPUS_STACK_PROTECTOR "Use stack protection")
+add_feature_info(USE_ALLOCA OPUS_USE_ALLOCA
+                 "Use alloca for stack arrays (on non-C99 compilers)")
+add_feature_info(CUSTOM_MODES OPUS_CUSTOM_MODES
+                 "Enable non-Opus modes, e.g. 44.1 kHz & 2^n frames")
+add_feature_info(BUILD_PROGRAMS OPUS_BUILD_PROGRAMS "Build programs")
 add_feature_info(
   FIXED_POINT OPUS_FIXED_POINT
   "compile as fixed-point (for machines without a fast enough FPU)")
@@ -161,8 +183,25 @@
           silk)
 
 target_link_libraries(opus PRIVATE ${OPUS_REQUIRED_LIBRARIES})
+target_compile_definitions(opus PRIVATE OPUS_BUILD ENABLE_HARDENING)
 
-target_compile_definitions(opus PRIVATE CUSTOM_MODES OPUS_BUILD)
+if(NOT MSVC)
+  target_compile_definitions(opus PRIVATE FORTIFY_SOURCE=2)
+endif()
+
+# It is strongly recommended to uncomment one of these VAR_ARRAYS: Use C99
+# variable-length arrays for stack allocation USE_ALLOCA: Use alloca() for stack
+# allocation If none is defined, then the fallback is a non-threadsafe global
+# array
+if(OPUS_USE_ALLOCA OR MSVC)
+  target_compile_definitions(opus PRIVATE USE_ALLOCA)
+else()
+  target_compile_definitions(opus PRIVATE VAR_ARRAYS)
+endif()
+
+if(OPUS_CUSTOM_MODES)
+  target_compile_definitions(opus PRIVATE CUSTOM_MODES)
+endif()
 
 if(BUILD_SHARED_LIBS)
   if(WIN32)
@@ -312,10 +351,19 @@
           DESTINATION ${CMAKE_INSTALL_PACKAGEDIR})
 endif()
 
-if(BUILD_PROGRAMS)
+if(OPUS_BUILD_PROGRAMS)
   # demo
+  if(OPUS_CUSTOM_MODES)
+    add_executable(opus_custom_demo ${opus_custom_demo_sources})
+    target_include_directories(opus_custom_demo
+                               PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
+    target_link_libraries(opus_custom_demo PRIVATE opus)
+  endif()
+
   add_executable(opus_demo ${opus_demo_sources})
   target_include_directories(opus_demo PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
+  target_include_directories(opus_demo PRIVATE silk) # debug.h
+  target_include_directories(opus_demo PRIVATE celt) # arch.h
   target_link_libraries(opus_demo PRIVATE opus)
 
   # compare
diff --git a/opus_buildtype.cmake b/opus_buildtype.cmake
new file mode 100644
index 0000000..6797f50
--- /dev/null
+++ b/opus_buildtype.cmake
@@ -0,0 +1,18 @@
+# Set a default build type if none was specified
+set(default_build_type "Release")
+
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+  message(
+    STATUS
+      "Setting build type to '${default_build_type}' as none was specified.")
+  set(CMAKE_BUILD_TYPE "${default_build_type}"
+      CACHE STRING "Choose the type of build."
+      FORCE)
+  # Set the possible values of build type for cmake-gui
+  set_property(CACHE CMAKE_BUILD_TYPE
+               PROPERTY STRINGS
+                        "Debug"
+                        "Release"
+                        "MinSizeRel"
+                        "RelWithDebInfo")
+endif()
diff --git a/opus_config.cmake b/opus_config.cmake
index e41d6b0..a0bfd58 100644
--- a/opus_config.cmake
+++ b/opus_config.cmake
@@ -3,11 +3,6 @@
 configure_file(config.h.cmake.in config.h @ONLY)
 add_definitions(-DHAVE_CONFIG_H)
 
-option(FIXED_POINT "Use fixed-point code (for devices with less powerful FPU)"
-       OFF)
-option(USE_ALLOCA "Use alloca for stack arrays (on non-C99 compilers)" OFF)
-option(BUILD_PROGRAMS "Build programs" OFF)
-
 set_property(GLOBAL PROPERTY USE_FOLDERS ON)
 set_property(GLOBAL PROPERTY C_STANDARD 99)
 
@@ -15,16 +10,6 @@
   add_definitions(-D_CRT_SECURE_NO_WARNINGS)
 endif()
 
-# It is strongly recommended to uncomment one of these VAR_ARRAYS: Use C99
-# variable-length arrays for stack allocation USE_ALLOCA: Use alloca() for stack
-# allocation If none is defined, then the fallback is a non-threadsafe global
-# array
-if(USE_ALLOCA OR MSVC)
-  add_definitions(-DUSE_ALLOCA)
-else()
-  add_definitions(-DVAR_ARRAYS)
-endif()
-
 include(CheckLibraryExists)
 check_library_exists(m floor "" HAVE_LIBM)
 if(HAVE_LIBM)
diff --git a/opus_sources.cmake b/opus_sources.cmake
index ecdf398..225543a 100644
--- a/opus_sources.cmake
+++ b/opus_sources.cmake
@@ -26,7 +26,8 @@
                  celt_sources_arm_neon_intr)
 get_opus_sources(CELT_SOURCES_ARM_NE10 celt_sources.mk celt_sources_arm_ne10)
 
-get_opus_sources(opus_custom_demo_SOURCES Makefile.am opus_demo_sources)
+get_opus_sources(opus_demo_SOURCES Makefile.am opus_demo_sources)
+get_opus_sources(opus_custom_demo_SOURCES Makefile.am opus_custom_demo_sources)
 get_opus_sources(opus_compare_SOURCES Makefile.am opus_compare_sources)
 get_opus_sources(tests_test_opus_api_SOURCES Makefile.am test_opus_api_sources)
 get_opus_sources(tests_test_opus_encode_SOURCES Makefile.am