Assumes the developer is solely responsible for the web site or application.
Where is this the case? We've got infastructure and security folks that are involved in the implementation and release and many developers have little or nothing to do with that.