diff --git a/docs/app-rails/application-security.md b/docs/app-rails/application-security.md index c274fc7..8c716bf 100644 --- a/docs/app-rails/application-security.md +++ b/docs/app-rails/application-security.md @@ -49,7 +49,7 @@ There is currently no file upload or download functionality at this time, so ple - [x] Use a secondary verification when users change their password - Note: Change password requires 6 digit code from email sent to user's email address. - [ ] Require user's password when changing email. -- [ ] Include honeypot fields and logic on Non logged in forms to catch bots that spam all fields (good resource: https://nedbatchelder.com/text/stopbots.html). +- [x] Include honeypot fields and logic on Non logged in forms to catch bots that spam all fields (good resource: https://nedbatchelder.com/text/stopbots.html). - [ ] Consider using Captcha on account creation, login, change password, and change email forms. - Note: Captchas are often not accessible to screen readers and their use should be part of a UX discussion. - [x] Filter log entries so they do not include passwords or secrets