I have to say, I think this is the sane choice. I evtaelaud WP a while back for suitability security-wise on our web servers (I work for a UK university). Things might have changed since then, but:They have a non-disclosure policy for security flaws, they bundle security fixes up with lots of other changes, so you have to reverse-engineer a large patch not just to isolate a security fix but to figure out what the security problem was. At one point, they even silently released a fixed tarball with the same version number as an existing one without an announcement.They advertised an announce list for releases which they never actually published to. When I pointed this out to them, I was told they'd lost the listserv password. Despite this, the list remained prominently advertised.