SA-CORE-2013-003 - Files directory Not fully protected
quote from SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities | Drupal.org:


  Additionally, the .htaccess of the temporary files directory and
  private files directory (if used) should include this command:
  
  Deny from all


instead of using .htaccess inside of /tmp directory (which can be wiped), I placed following rule inside of my pressflow.conf:

&lt;Directory "/tmp"&gt;
    Deny from all
&lt;/Directory&gt;