&gt; Seafile has a much smaller attack surface (no PHP, MySQL not required, etc)<p>ownCloud does run a successful Bug Bounty program and is paying for security bugs: <a href="https:&#x2F;&#x2F;hackerone.com&#x2F;owncloud" rel="nofollow">https:&#x2F;&#x2F;hackerone.com&#x2F;owncloud</a><p>Also I have published a blog post elaborating why CVEs are not everything when it comes to comparing the security of products: <a href="https:&#x2F;&#x2F;statuscode.ch&#x2F;2015&#x2F;09&#x2F;ownCloud-security-development-over-the-years&#x2F;" rel="nofollow">https:&#x2F;&#x2F;statuscode.ch&#x2F;2015&#x2F;09&#x2F;ownCloud-security-development-...</a><p>Furthermore please take a look at <a href="https:&#x2F;&#x2F;seacloud.cc&#x2F;group&#x2F;3&#x2F;wiki&#x2F;security-records&#x2F;" rel="nofollow">https:&#x2F;&#x2F;seacloud.cc&#x2F;group&#x2F;3&#x2F;wiki&#x2F;security-records&#x2F;</a>. Not using PHP doesn&#x27;t make everything more secure magically, neither does using PHP make things more secure.