1. Very little. 2. Very little. I've was the primary developer on an at-one-time popular site, and have been working at web startups for awhile. I don't recal

1. Very little. 2. Very little. I've was the primary developer on an at-one-time popular site, and have been working at web startups for awhile. I don't recall a single malicious user on either (there were quite a few stupid users or users angry at me, but not messing with the site). Until you get big, people won't mess with you. Until you get big, you have little to lose if they randomly do mess with you. Writing robust secure apps is harder. Unless you deal with money or credit cards, just figure it out when it is actually a problem. (Protip: you will probably never be big enough for it to be a problem. I would spend all your effort figuring out how to get big, and then welcoming malicious users and script kiddies as one of the trimmings of success).