diff --git a/content/guides/13.security/1.best-practices.md b/content/guides/13.security/1.best-practices.md
index 8220dd6d0..58e2be2ba 100644
--- a/content/guides/13.security/1.best-practices.md
+++ b/content/guides/13.security/1.best-practices.md
@@ -19,6 +19,7 @@ Flows run arbitrary operations. They can execute custom scripts, make HTTP reque
 - Grant create, update, and delete on `directus_flows` and `directus_operations` to administrators only.
 - For flows with a **Webhook** trigger, treat the trigger URL as a public endpoint. Require an access token or a shared secret in the request, and validate the payload inside the flow before taking action.
 - Audit any flow that contains a **Run Script** operation before enabling it. Script operations execute Node.js code with the privileges of the flow's accountability.
+- A **Manual** trigger flow lists its target collections in the `options` field, potentially exposing the names of collections a user has no permission to access. To prevent this keep flows used by lower-privileged users separate from those that reference restricted collections.
 
 ### Settings