diff --git a/best_practices/security.rst b/best_practices/security.rst
index f3ff7b40fe3..77f23f562e6 100644
--- a/best_practices/security.rst
+++ b/best_practices/security.rst
@@ -43,6 +43,7 @@ which uses a login form to load users from the database:
 
 .. code-block:: yaml
 
+    # app/config/security.yml
     security:
         encoders:
             AppBundle\Entity\User: bcrypt