diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md
index 57b1172d5e6..af0d5ca4426 100644
--- a/doc/development/shell_commands.md
+++ b/doc/development/shell_commands.md
@@ -1,5 +1,11 @@
 # Guidelines for shell commands in the GitLab codebase
 
+## References
+
+- [Google Ruby Security Reviewer's Guide](https://code.google.com/p/ruby-security/wiki/Guide)
+- [OWASP Command Injection](https://www.owasp.org/index.php/Command_Injection)
+- [Ruby on Rails Security Guide Command Line Injection](http://guides.rubyonrails.org/security.html#command-line-injection)
+
 ## Use File and FileUtils instead of shell commands
 
 Sometimes we invoke basic Unix commands via the shell when there is also a Ruby API for doing it.