development-guidelines.md: passwords in code policy