add some security guidelines