diff --git a/content/guides/13.security/1.best-practices.md b/content/guides/13.security/1.best-practices.md
index 4ac30fb83..902d6bccf 100644
--- a/content/guides/13.security/1.best-practices.md
+++ b/content/guides/13.security/1.best-practices.md
@@ -129,7 +129,6 @@ Since password validation runs on the main event loop and is performed whenever
 The public role has no file upload permission by default, and that is the safe choice. Granting the public role create access on `directus_files` lets any unauthenticated request upload arbitrary files to your storage backend, leading to storage exhaustion, delivery of hostile content from your domain, and abuse of your project as an open file host.
 
 - Do not grant create on `directus_files` to the public role.
-- If you need to accept uploads from unauthenticated users (for example, a contact form with attachments), receive the file through a flow that validates MIME type, size, and content, then writes the file under a service account.
 - Configure [`FILES_MAX_UPLOAD_SIZE`](/configuration/files#upload-limits) and [`FILES_MIME_TYPE_ALLOW_LIST`](/configuration/files#upload-limits) to limit the shape of acceptable uploads.
 
 ### Prefer Authorization Headers for Asset Requests