We do: almost any framework will prevent sql injections automatically and the same for things like CSRF or HTML injection. What we don't do is have a checklist

We do: almost any framework will prevent sql injections automatically and the same for things like CSRF or HTML injection. What we don't do is have a checklist to go through. We haven't considered these things, because we have _eliminated the posibility_ of that particular issue. That doesn't mean it is always safe: it just means that there new and exciting hacks to discover.