[FD] Defense in depth -- the Microsoft way (part 34): our developers and our QA still ignore our own security recommendations