Thank you very much for putting this document together. It is good to be proactive and share information about the processes and steps taken to keep WordPress secure. I learned some things from reading it. Security is a process.

It is my belief that WordPress is as secure or more secure than other similar CMS projects. It pains me when people make off-hand comments about the lack of WordPress security because it is clear they are not well informed. I guess that we don't do ourselves any favors with the periodic security fire drills: a plugin or theme has a security issue and then people publish articles with headlines like "WordPress security issue, thousands of sites affected." This is often well meaning, in that people are trying to get the word out, but it distorts the truth.

Automatic updates are, in my opinion, tremendously important. I applaud the team that had the guts to go ahead with the effort despite the fears of many people.