Django protect you out of the box of xss, csrf, and click jacking while providing you with a proven robust extensible auth mechanism.

When using flask, you have to be able to make decisions about those. Many devs are not able to.

I'm ok with it: not everybody has to be an expert to be a great element in a company. But flask gives those profile a false sense of easiness.

I have seen a fare share of terribly written django apps, riddled with security holes that weren't so obvious at the first glimpse.

> But flask gives those profile a false sense of easiness.

It allows you to prototype very fast, not everyone needs nor wants the hand-holding that django provides.

Don't get me wrong I think django is fantastic at what it gives out of the box but saying that flask is insecure is just fud.

Also - try Pyramid, you'll never know when it suits your needs https://trypyramid.com/

Have you ever written a flask app yourself? It provides identical protections against xss etc. that you mentioned, as well as an auth plugin and tutorials on doing auth right... I think it's unfair to spread a negative opinion of Flask because you had to work on an app that used it badly.