ACP security tips

_data/sidebars/acp_user_sidebar.yml

@@ -10,6 +10,8 @@ entries:
             url: /docs/acp/user/intro-to-acp/acp-overview.html
           - title: ACP security assessment
             url: /docs/acp/user/intro-to-acp/aop-security-assessment.html
+          - title: ACP security tips
+            url: /docs/acp/user/intro-to-acp/acp-security-tips.html
       - title: Install ACP catalog
         url: /docs/acp/user/app-composition-platform-installation.html
       - title: Develop an app

docs/acp/user/develop-an-app/develop-an-app.md

@@ -37,9 +37,11 @@ You need to have a clear understanding of what your app API will provide to othe
 Before you start with the development, you should design your API schema files. Depending on your requirements, you can have an OpenAPI or an Async API schema file. In this step, you define the Sync API endpoints your app will provide to others, the messages you will emit or consume, and the data you expect to work with.
 
 {% info_block infoBox "Info" %}
-For more information about Async API schema design, see [Designing your APIs with Async API](https://www.asyncapi.com/blog/designing_your_apis_with_asyncapi_part_1). 
+
+For more information about Async API schema design, see [Designing your APIs with Async API](https://www.asyncapi.com/blog/designing_your_apis_with_asyncapi_part_1).
 
 For more information about OpenAPI schema design, see [Best practices in API design](https://swagger.io/resources/articles/best-practices-in-api-design/).
+
 {% endinfo_block %}
 
 You can use the following tools to design your APIs:

docs/acp/user/intro-to-acp/acp-security-tips.md

@@ -0,0 +1,7 @@
+---
+title: ACP security tips
+Descriptions: Guidelines and tips on how to make your ACP apps secure
+template: howto-guide-template
+---
+
+To prevent unauthorized access to the App Catalog and its configurations, we recommend to limit access to it by implementing user roles. Configure your project to designate an admin user with access to the App Catalog page. For everyone else, hide the `/app-catalog-gui/`page by assigning specific user roles. For detailed instructions on creating and managing user roles, see [Best practices: Manage users and their permissions with roles and groups](/docs/pbc/all/user-management/{{site.version}}/base-shop/manage-in-the-back-office/best-practices-manage-users-and-their-permissions-with-roles-and-groups.html).