BLOG or Support FAQ about user sign in payload?

I am building an app and using a sign in payload to identify the user and acquire their rAddress.

My implementation is custom, using the qr_code and web socket_status.

I want to put a link on the custom popup, to a document hosted by XUMM, that basically explains why a signing transaction is safe.

Can someone please provide a link to a document that explains to the user the obvious stuff, such as no access to keys, funds, etc. Also for user protection a note that they should ensure the payload is a sign in and not some other.

I was going to write something but i figure you probably already have this somewhere (although after a quick google I don't find it.) and of course much better if the page i point users to, originates from XRPL labs.

Many thanks.

Chris@xrpl365