> Seafile has a much smaller attack surface (no PHP, MySQL not required, etc)

ownCloud does run a successful Bug Bounty program and is paying for security bugs: https://hackerone.com/owncloud

Also I have published a blog post elaborating why CVEs are not everything when it comes to comparing the security of products: https://statuscode.ch/2015/09/ownCloud-security-development-...

Furthermore please take a look at https://seacloud.cc/group/3/wiki/security-records/. Not using PHP doesn't make everything more secure magically, neither does using PHP make things more secure.