Performance is adequate, security is up to the dev.
As in basically any web app development... mostly independently of the chosen implementation language. PHP hast lost its insecure beginnings (like injecting variables using GET arguments...) since long.