Most of these are "nice to have" security features or defaults rather than massive holes. Frameworks should have good security, but you also need to protect you

Most of these are "nice to have" security features or defaults rather than massive holes. Frameworks should have good security, but you also need to protect yourself from things like slow loris DoS in your own code. You need to add these protections when using any framework.