* Uses arcane define() statements to set configuration
* No ORM -- provides a slim wrapper around mysqli
* Uses singleton classes -- makes any potential unit testing very cumbersome
* Rudimentary routing system -- doesn't support anything beyond /$CONTROLLER/$ACTION/$ARGS...
* Rudimentary templating system that does simple string-replacement -- doesn't support looping or conditional control structures
* Database::safeQuery() is anything but safe, in fact it's quite dangerous -- prepared statements should be used at a minimum rather than blind string replacement (see mysqli::prepare())
This seems like it was an interesting learning exercise for the author, but it's not much beyond that.
The next step would probably be to make it PSR-1 and PSR-2 compliant (note how public/private accessors are absent in many places, and indentation swaps between spaces and tabs), and make it fit within the composer packaging system.