Security is only part of the frameworks job. It should definitely follow best practices and have functions to deal with security concerns. But its really the jo

Security is only part of the frameworks job. It should definitely follow best practices and have functions to deal with security concerns. But its really the job of the programmer to make sure his/her code is secure. And I don't just mean sanitizing data. For example it's not the frameworks responsibility to make sure you don't put a sequential session ID in a cookie that could easily be hijacked.