One default security improvement we added to @discourse that I wish we had figured out a long time ago — automatically invalidate (require re-validating email) any admin account that hasn’t logged in for a year or more