This question on SO (how to hash a password?) begs the question; How do I answer a question when doing so might facilitate a train wreck?
Eric Lippert's non-answer "Getting password security correct is about a heck of a lot more than getting SHA512 implemented correctly." is more pertinent to the original poster than the actual answer.
Should anyone answering the question have included additional caveats?
If you want to include additional caveats, sure, go ahead; but I wouldn't feel personally responsible if those using my answers do something Really Stupid™. (I would feel responsible for giving bad advice, so don't do that.)
As far as covering your own legal bases, the license currently used for SO (and linked at the bottom of every page) says:
5. Representations, Warranties and Disclaimer
UNLESS OTHERWISE AGREED TO BY THE PARTIES IN WRITING, LICENSOR OFFERS THE WORK AS-IS AND MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND CONCERNING THE MATERIALS, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR THE ABSENCE OF LATENT OR OTHER DEFECTS, ACCURACY, OR THE PRESENCE OF ABSENCE OF ERRORS, WHETHER OR NOT DISCOVERABLE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SUCH EXCLUSION MAY NOT APPLY TO YOU.
That's always a tough call, and it's hard to give good guidelines on how to handle it. In similar situations, I typically try to answer the immediate question and also point out that the approach to the larger problem may not be correct. Kind of like, "Well, okay, you point the gun at your foot and pull the trigger. However, you might consider whether or not you really want to shoot yourself in the foot."
I hover around the Security tag quite a lot, and I see a lot of awkward questions.
Quite often its obvious the questioner doesnt really know where to begin, other then they have a vague notion that something should be 'encrypted' (by which they frequently mean hashed). In those cases its hard to give a good answer, because the truthful answer would be 'go away, research what you really need, then come back and ask a better question'. Trying to answer otherwise can often lead to a stream of 'comment questions' such as 'what block size should I use', 'how do I generate a salt/IV' etc etc and you get sucked into a trap of editing your question and tring to write a comprehensive guide to cryptography for newbies.
I do however disagree with the larger point that the answer should be 'get an expert in'. Really strong crypto is hard, but most people dont need government strength encryption. I have a lock on my front door. It will stop 90% of people walking through, but I'm well aware that anyone with a slight amount of determination will be able to get through it. That doesnt make my lock useless. I would consider upgrading it to a steel door with iris recognition slightly overkill.
The danger with crypto is that people see their data being converted to gobbledegook and assume that its safe, without really being sure how safe it is. Thats fairly true of all walks of life though. In cases where we feel there is a risk we ask experts for advice. Stack Overflow is a great place to ask for expert advice. Its just unfortunate that quite often the advice given is bad, or lacking in detail. And that could lead me off onto a rant... lets just say its not ideal (especially around specialist knowledge areas) that all upvotes are equal.
To an extent I would agree - yes, some sort of caveat might be necessary where actual code snippets exist. Those answers where only links are included, probably not necessary. However, no matter how cheap the solution, it should not be entirely free - especially when it comes to security (if it's worth securing, it's worth spending some money on).
Now...that said, if I had a manager that made the decision to use code snippets off of any website without some serious consultation (either from a shrink or security expert), I would hire that shrink to have his head examined.
Now, to answer your question - if you supplied any code, I would put a disclaimer just to CYA. Is this overkill? Maybe. But did you hear about the man who decided to use his lawn mower as a hedge trimmer; cut his fingers off; sued the lawn mower manufacturer...and won? Obviously, no matter how ludicrous most of us think an idea is, someone out there is willing to try it.
EDIT: All that said, @The Cat points out that SOFU has a disclaimer. Never hurts to add your own when something is as important as security is concerned.
