Ok, trp.red is written in php right? It's forum functionality is nothing new or complicated. I'm a developer and would love to review the code for it. I'm willing to bet it doesn't break the 5,000 line mark. If there were a few of us reading and reviewing pull requests I'm very confident we could keep it free from any application level vulnerabilities.