Security starts with defaults. A CMS should separate roles, protect forms, avoid raw scripts from editors, and keep production configuration strict.
