The main point I've been trying to get across is that the fact you have only seen small vulnerabilities does not mean big ones don't exist! And that [found vul

The main point I've been trying to get across is that the fact you have only seen small vulnerabilities does not mean big ones don't exist! And that [found vulnerabilities per time unit] * severity = [overall product security] is a fallacy in general. In fact, showing that symfony has had vulnerabilities was a good thing in my book. Anyway, it's great you've found some framework you feel comfortable with. That's an awesome thing to have.