It's been about four years since we touched it. When we used Waterline (the Sails ORM), we discovered two distinct SQL injection vulnerabilities in it, without intentionally looking. I would link the related issues, but they seem to have disabled Github issues in the waterline repository[1]. That--and lots more--scared us away. We switched happily to Hapi[2] with about a week of work and never looked back.

1. https://github.com/balderdashy/waterline

2. https://hapijs.com/