Good Work Andy. I might also point out that if you are very serious about security knowing your hosts abilities is more important than ever. For example: With Full Trust any web application running can scan any other web application on that same server such as retrieving a listing of files and directories outside of the root where the code executes. Bad.

The solution is to run in Medium trust and open up only the areas that need (Like what Andy has provided) this does not pose such a security risk as full trust. However, just because your host is running medium trust does not mean you are safe. A malicious user can override the hosts medium trust settings if the host has not prevented this with: "allowOverride="false" in the machine level web.config file.

Dedicated server clients where you are in full control of your box are ok to run in Full Trust as there will be no unknown shared users on your system.