For a transaction that either isn't shipped immediately (any retailer of physical goods) or that you can rescind (digital item with DRM), it's perfectly safe to

For a transaction that either isn't shipped immediately (any retailer of physical goods) or that you can rescind (digital item with DRM), it's perfectly safe to accept a transaction that has been propagated to the network but that hasn't been 'confirmed' yet. However, you wouldn't want to, for example, run a gambling site that accepts and pays out bets immediately after they show up as 'unconfirmed' because you wouldn't have recourse if they managed to double spend.