What about CodeIgniter security versus Laravel security?

Both can be secure when maintained properly. Laravel ships with stronger defaults across CSRF, XSS, SQL injection prevention, password hashing, encryption casts, and route signing. The security patch cadence on Laravel is faster because the maintenance team is larger and the active codebase sees more security review. CodeIgniter 4 is materially better than CodeIgniter 3 on security defaults, but the gap to Laravel is real. Where CodeIgniter applications get into trouble is usually CodeIgniter 2 or 3 legacy code with custom security implementations that have not aged well.