As a Drupal dev, I couldn't recommend any CMS if we go by that standard. None of them are secure forever. A security policy is what makes a CMS trustworthy, as

As a Drupal dev, I couldn't recommend any CMS if we go by that standard. None of them are secure forever. A security policy is what makes a CMS trustworthy, as there will always be holes. As a guy who dislikes it (and doesn't know all that much about it), I still find Rails' security policy to be efficient and reasonable.