I have some Django sites deployed using Apache2 and mod_wsgi. When configuring the WSGIDaemonProcess directive, most tutorials (including the official documentation) suggest running the WSGI process as the user in whose home directory the code resides. For example:

WSGIScriptAlias / /home/joe/sites/example.com/mod_wsgi-handler.wsgi
WSGIDaemonProcess example.com user=joe group=joe processes=2 threads=25

However, I wonder if it is really wise to run the wsgi daemon process as the same user (with its attendant privileges) which develops the code. Should I set up a service account whose only privilege is read-only access to the code in order to have better security? Or are my concerns overblown?