Making sure you're getting what you think you're getting Don't let one user run client-side code on another user's browser Don't let a malicious user monkey around with your database or filesystem.