Well this could be a very wide question as every project have different philosophies. But meanwhile question is that We have lot of projects like Yii, Drupal, Apigility which requires full write permission on code folders itself ( I think for generating code from web browser page ) .
This could be great feature but still this is also a great security issue for give your whole (or some part of) code to world/apache writable permission. Most of time their argument is that code is generated on dev machines, while during production deployment, code will have actual permissions.
But still it have lot of security issues. Dev machine with world writable code. Also big chances are some of writable are also deployed on production too. Again most of programmers (I met) do not about care file permissions. They are very ready to give 777 if any permission issue block their path.
So If enterprise/industry level applications/projects show same attitude for requiring apache write permission on whole code folders, Then how developer attitude for file system security can be improved.
Practical scenario is that One colleague of me tell me about Apigility require permission to folders So he want what solution I propose to fix. I tell him it is bad practice to give world writable permission ( In this case ZF2 whole module folder ). And their should be any alternative path by apigility itself. But when I searched on Apigility page/forums, They promote to give write permission to module and config folders.
If I am going paranoid about all this and file system security do not impact by this ?