https://ludovicianul.github.io/posts/incomplete-list-security-practices/