add reminder about how to make #show more secure