https://infosec.mozilla.org/guidelines/web_security