Hacker News Reader

Django actually has pretty good out of the box security settings and support for XSS, CSRF and SQL injection protection, support for bcrypt and argon2, setting password rules/validation through settings, etc:

https://docs.djangoproject.com/en/1.11/topics/security/

EmberJS handles all the aspects that purely browser-based application code can - protecting from XSS attacks, setting up your Content Security Policy, and client side input validation.

No much at all.

For RoR many of the app-level points are - CSRF, SQL escaping, bcrypt by default, etc. That's a big reason to use such a framework in the first place.

Yeah, what kind of shitty frameworks is this person using if the answer to this question is "not much at all?"