Web deployment policies
From Jon's Wiki
- Server code should not be able to write to itself
- one user for webserver (fastcgi?) to run as, one for deployment
- data stored by the webserver (or other server) goes in /var/lib/ (probably /var/lib/sitedata/<sitename>)
- config should live under /etc/, and not in the docroot/code
- Use SSL/TLS wherever possible
- Use salted good hashes for passwords