An indemnification clause is a good idea. In this case, the web developer would commit to be liable for any security breaches, should they result in a loss or cause a third party to sue.The computation of this compensation can also be stated. My only worry would be bringing this up in the middle of the contract.