Before you ship a “security mitigation”