Personally I do most of the development in PHP (the programming language doesn't really matter for this question). Popular PHP frameworks along developers are for example:
From this three frameworks, I know most about CodeIgniter and in general I think they supply developers with a good input library and pay extra attention to security. Also they have a security program in order for researchers to report vulnerabilities in the framework in order to fix those. Disclaimer: I'm also contributing to the CodeIgniter framework and their security program.
My general question is: is it better to rely on an existing framework for developing an application in order to extend a basic security-by-design structure. Or is it safer to start from scratch and develop everything yourself?
In other words: With security-by-design in mind, is it safer to start developing an application based on an existing application framework or to start from scratch with a custom build design?
Let alone that developers of course need to use the framework functions properly in order to benefit of them. The same applies on custom build functions/features.