Security best practices update

The security best practices was pretty incomplete, so I gave it a rewrite. There may be a few more points I didn't touch on, so a few more eyes on it would be good.