I don't think less code = less security issues. Often using those secure-by-default frameworks require more code. The simplest example in PHP (highlighted in t

I don't think less code = less security issues. Often using those secure-by-default frameworks require more code. The simplest example in PHP (highlighted in the article for its default-insecurity): echo '<h1>Hello ' . $_GET['name'] . '</h1>'; is vulnerable to XSS. echo '<h1>Hello ' . htmlentities($_GET['name']) . '</h1>'; is not vulnerable