If you've decided to self-host a WCF service - or as in my case you already have a service in production but need it to be consumed by a Silverlight application, but keep on getting a security exception, here's a method of getting your existing services to work. It involves getting the WCF service to serve a "file" called "clientaccesspolicy.xml" when one is requested, as is done by Silverlight.