user:group setting on deployed app directory

Hello,
I've been able to setup capistrano to deploy my PHP app from my
development server to my production server.  It's performing the
deployment as another user other than root.  The user and group is
'deploy:deploy'.  Is this a security problem if my app is accessible
to the public? What's the convention for setting user:group on apps
deployed by capistrano?