Thanks for the contribution, @TheodorNEngoy.

This likely should not be a separate doc. Take a look here: #2196

If there is anything missing from the SBP doc, we should add it there.

Thanks for the pointer, makes sense.

I just pushed an update that removes the standalone server-hardening tutorial + nav entry, and instead folds that checklist into the Security Best Practices doc as a short Practical Hardening Checklist (Servers) section (updated in both draft and 2025-11-25).

If you’d prefer this live elsewhere (or align wording/structure with #2196), I’m happy to adjust.

Yeah, no need to modify it across two spec versions. I recommend keeping this open for now, and once #2196 merges, then just amend it with your suggestions and we can review them then. Helps avoid churn.

Also, @TheodorNEngoy - I'd recommend structuring it in a way that is similar to what SBP already does. That is - instead of having a "hardening" checklist, structured it through the threat/mitigation/mistakes frame that you already might see in the doc.

Makes sense.

I pushed a small follow-up to reduce churn: this PR now only touches docs/specification/2025-11-25/basic/security_best_practices.mdx (dropped the duplicate change in draft).

I’ll keep this open but pause further edits until #2196 lands; then I can rebase/amend and re-structure the additions in the same threat/mitigation/mistakes style as SBP (vs a standalone “hardening checklist”).