Google Online Security Blog: Do Know Evil: web application vulnerabilities
http://googleonlinesecurity.blogspot.com/2010/05/do-know-evil-web-application.html