Using a service like PagodaBox helps a lot with the security issues. The filesystem for everything but uploads is read-only.