The one caveat I'd toss out there, in the XSS realm (which can be used to deface your site, steal user credit cards, etc...), is to be careful about 3rd party j

The one caveat I'd toss out there, in the XSS realm (which can be used to deface your site, steal user credit cards, etc...), is to be careful about 3rd party javascript includes. Those players are really big fish, since a successful hack there, also means they've hacked 1,000 customer sites at the same time. Including yours. Treat externally sourced javascript like a snake. It might be fine, or it might be poisonous. Try to use local javascript as much as possible, and use SSL when you can (to prevent man in the middle and most cache poisoning attacks).