give me recommendations for good because some developers think normalizing terrible security practices is a document for moderators specifically.