rob006 I disagree with this. Right now, the main goal of the core team is to build an extender API that lets extension developers develop quickly and efficiently without significantly endangering security. Of course, it's possible to make an extension that breaks security, otherwise extensibility would be extremely limited. And larger extensions, naturally, will be more complex, but that holds for any software product. But the reason why software like Wordpress gets bad reputations for security is because their extension API is clunky and poorly designed. As a contributor, my goal is to minimize accidental security issues through helping build a robust API.
Additionally, as luceos mentioned, some of the most widely-used extensions are created by, or adopted by, organizations like Friends of Flarum that have robust, professional development teams.
