be careful not to confuse Django the framework (which is not a cms) with Django-CMS the cms built on top of Django the framework by a different set of people. I

be careful not to confuse Django the framework (which is not a cms) with Django-CMS the cms built on top of Django the framework by a different set of people. I cannot comment on the security of django-cms because I didn't look into it but Django the framework tends to be "secure by default" i.e. has defaults that enforce csrf protection and other security best practices.