hi,
just my two cents about security, a way not to be easily hacked is not having people guess what cms you’re using too easily...
having a look at the source code is the first way one know what tool you’re site is running with (don’t you guess what cms is behind a website with wp-content in the link/script tags in the head part.
MODx has a very generic /assets/css... and so on "annoucement" which is a good beginning
This, of course not speaking about how things are coded (drupal is not exactly known to be an example about this, particularly when it comes to its sql requests...)
Something else, of course i wish MODx to be knwon as The cms that FTW but, in the other hand, the more a cms is wellknown and claiming to be the best the more it is hacked, remember PhpBB a few years ago... claiming to be the best and... being the most hacked forum machine... i would bet MODx is not tempting hackers as much as Drupal or Joomla (so far...)
Have swing