Yes, such a system is dangerous. A client is asking for an opensource one as he can't pay for a custom made one. I'll be customizing the front-end and possibly the back-end.
I have explained him all the insecurities and everything to him. But he still needs an opensource one.