Have there ever been exploits in closed source software, including 0-day exploits? Most definitely. So you would want to use the highest quality software you c

Have there ever been exploits in closed source software, including 0-day exploits? Most definitely. So you would want to use the highest quality software you can for a given purpose, but even that isn't enough. In reality, the answer is defense in layers. First layer -- if you are running on RedHat or CentOS, make sure to have SElinux in enforcing mode, and resolve any SElinux errors the correct way. Second layer -- separation of concerns. The same way that many businesses accounting operations are set up, you need to have a security breach at several layers at the same time to have an issue. This may mean that having the public facing web server talk to an app on an internal server, using a defined API, and that internal server only has firewall rules open for what is required. That internal app server then may have access to a database server in another security zone, making requests utilizing specific API patterns. At each level, have auditing software to look if any of those patterns change unexpectedly. Also, rate-limit the amount of data that can be pulled from the DB server on a daily basis -- this would mitigate a massive data dump situation. You could go even further, and have the web-facing side talk to an internal web server, after going through a layer that validates each request fits a given pattern. Of course this is a pain to keep updated as the app gets updated, but then again when the consequences of a security breach are high enough, this level of pain is worth it.