Explain where the default password validation is

diff --git a/doc/security/password_length_limits.md b/doc/security/password_length_limits.md
index dee2bcd..c8d66e9 100644 (file)
--- a/doc/security/password_length_limits.md
+++ b/doc/security/password_length_limits.md
@@ -1,6 +1,7 @@
 # Custom password length limits
 
-If you want to enforce longer user passwords you can create an extra Devise initializer with the following steps:
+If you want to enforce longer user passwords you can create an extra Devise initializer with the steps below.
+If you do not use the `devise_password_length.rb` initializer the password length is set to a minimum of 8 characters in `config/initializers/devise.rb`.
 
 ```bash
 cd /home/git/gitlab