Never say "The framework does it - I do not need to test this"!

Don't expect "secure by default" - There are ever so many interpretations of "secure"