Anyone else find this sort of thing terrifying from a security perspective? Taking a webapp, still under development, often running under a developer's user acc

Anyone else find this sort of thing terrifying from a security perspective? Taking a webapp, still under development, often running under a developer's user account out of their home directory, and exposing it to the internet at large? shudder