I agree with your intent. I do. If you're a high-profile site, or you're storing extremely sensitive customer data, this is absolutely something you need to be

I agree with your intent. I do. If you're a high-profile site, or you're storing extremely sensitive customer data, this is absolutely something you need to be doing. But your audience here is startups. Almost always, these startups are cash-strapped, time-crunched, and have zero dedicated ops guys. Ideally, even these types of businesses would prioritize security to the level you're asking. In reality, as I said in my previous comment, almost none of the startups I've worked at have had the ops capacity necessary to handle this. Even with package management, servers go months without having critical security patches applied. Asking these types of companies to do something that increases the ops overhead necessary to apply patches is going to result in a worse outcome. Keep in mind that it's not simply compiling from source and having infrastructure to apply security patches across multiple boxes. It's also keeping an eye out for reported vulnerabilities — and not all projects have dedicated security mailing lists. Not all projects even report this information via mailing lists. I wish it were different. I understand where you're coming from. But the incentives are set up ass-backwards, and until companies start having serious liability for data breaches, protecting customer data simply isn't going to be a priority. In the meantime, encouraging them to set up their infrastructure in a way that requires even more ops effort when they're already struggling to keep up is going to have an adverse outcome.