If you use a framework like Laravel it probably covers most things.

You could easily write a massively insecure application in core python, but things like Zulip use Django which shields you from most of it.