What? Was this meant as a joke in relation to something else? -- Why shouldn't you log into banking sites with it?
1) Probably won't have done the full sort of inspection of our SSL cert checking to really ensure you aren't being MITM'd.
2) We won't have a chemspill / 0-day security fix infrastructure in place, so we won't have a way to push down fixes to 0-day exploits in OpenSSL, the JS engine, etc.
I'd love to be at a better point on those features by the end of this year, but it's not likely with our current roadmap & resourcing plan.
e.g. how will 1.0 be any more secure than alpha aside from developers having more time to "run into" the security issues by sheer luck/accident?
Maybe someone vet the code by hand -- or maybe they will use a security testing suite to automate it? If so, wouldn't it make sense to do that before accepting code that could potentially introduce security bugs?
I think their point is that correct, well-thought-out and well-tested code (i.e. doing exactly what it needs to do, without side effects and errors) will inherently be more secure than any hacked-together it-runs-ship-it MVP/alpha/demo release (which is what Servo is, at the moment).
Security-specific tests would be done in the same way as they're done for any mainstream engine out there.