diff --git a/App-Security.md b/App-Security.md
index 1959c13..c9cce5d 100644
--- a/App-Security.md
+++ b/App-Security.md
@@ -30,9 +30,9 @@ From ``./lint --show AllowBackup``:
 ### Passphrase Cache
 TODO, also: https://github.com/open-keychain/open-keychain/issues/894
 
-  1. Start OpenKeychain
-  2. Sign something, caching the passphrase
-  3. Open a shell and execute these commands:
+1.   Start OpenKeychain
+2.   Sign something, caching the passphrase
+3.   Open a shell and execute these commands:
      ```bash
 someuser@somehost platform-tools> ./adb shell
 $ su
@@ -63,7 +63,7 @@ heap-dump-tm1313854763-pid17973.hprof
 someuser@somehost platform-tools> ../tools/hprof-conv heap-dump-tm1313854763-pid17973.hprof apg.hprof
 someuser@somehost platform-tools> jhat apg.hprof
      ```
-  4. Open a browser with ``http://localhost:7000`` and find ``CachedPassphrase`` class, see [PassphraseCacheService.java#L517](https://github.com/open-keychain/open-keychain/blob/development/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/service/PassphraseCacheService.java#L517)
+4.   Open a browser with ``http://localhost:7000`` and find ``CachedPassphrase`` class, see [PassphraseCacheService.java#L517](https://github.com/open-keychain/open-keychain/blob/development/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/service/PassphraseCacheService.java#L517)
 
 ### Attacking passphrase cache with root access