Web deployment policies
From Jon's Wiki
- Server code should not be able to write to itself
- one user for webserver (fastcgi?) to run as, one for deployment
- config should live under /etc/, and not in the docroot/code
- Use SSL/TLS wherever possible
- Use salted good hashes for passwords