Apple WebObjects 3.5 - Manual (Page 160)

Chapter 9 Deployment and Performance Issues
160
NeXT_ROOT /NextLibrary/WOApps . Thus, you can install the entire directory under
/WebObjects , but doing so presents a security problem if you have scripted
components. Any client can access any file under the document root, which
means that if you install scripted components under the document root, you are
exposing source code to outside users.
Instead, it is recommended that you install most of the application in
NeXT_ROOT
/NextLibrary/WOApps and install only the web server resources under the
document root. It is also recommended that you install the application directly
in the
/WebObjects directory rather than in a subdirectory. If you install in
a subdirectory, your application can still run but cannot find image files unless
you provide the application path on the command line. For more information,
see Serving WebObjects.