Add password policy to best practices

content/guides/13.security/1.best-practices.md

@@ -113,6 +113,15 @@ Administrator accounts can read and write any data in the project and change per
 
 Require [Two-Factor Authentication](/guides/auth/2fa) for every user with an administrator policy, and review the administrator user list on a regular cadence.
 
+### Use Safe Password Policy Patterns
+
+The password policy (Settings → Auth → Password Policy) is a regular expression evaluated against every submitted password. The built-in **Weak** and **Strong** presets are designed to be safe. However, custom patterns have no such restriction, adding a custom rule with nested quantifiers (e.g. `(a+)+$`) can be vulnerable to catastrophic backtracking. 
+
+Since password validation runs on the main event loop and is performed whenever a password is created or updated (including public registration and password resets) a poorly designed pattern could be exploited remotely to degrade performance or make the instance unresponsive.
+
+- Prefer built-in presets whenever possible, as they are safe by design.
+- When using a custom regex, avoid nested quantifiers (e.g. `(x+)+`, `(x*)*` etc) and test the pattern against long, non-matching inputs before deploying it.
+
 ## Files & Assets
 
 ### Restrict Public File Uploads