A sample setting is shown below. This sets the security file to be the file ComputeSiteSecurity.m found in the WEB-INF directory.

<SecurityConfigurationFile>
  /WEB-INF/ComputeSiteSecurity.m
</SecurityConfigurationFile>

A sample contents for the security file is shown below. This is a very conservative security model, which allows all symbols in Global` context as well as a small number of system symbols.

{
"AllowedContexts" -> {"Global`"}
,
"AllowedSymbols" -> 
    HoldComplete[ Plus, Times, Power, HoldComplete]
}