frameworks

Every now and then (and recently on another post) some argue that
"frameworks" aren't needed.

I'm not arguing that all frameworks are good, or bad. I would argue
that if one gets an app from github using a "framework", then you
assume certain things about the app, based on the underlying
framework. Now, can this/these implied assumptions be correct?

I'm not sure, as I don't know if any framework has a "testsuite" that
one can run to ensure the app is actually using the underlying
framework. So the app could have serious holes in it.

The same can be said for a php app that's home grown. Who really knows
what you're getting. Unless the app is from a "solid" operation
(msft/goog/meta/etc..) who knows what you'd really be getting
underneath the covers.

So.. what's a small  dev to do!

In a reasonable dev env, you'd have the dev process, as well as test
(considerable), both during dev, as well as pre production. You'd have
security tests running through a bunch of scenarios including all
kinds of external   situations/inputs, edge cases, etc..

feel free to comment (reasonable/no screaming!!)

thanks