I lol'd. Didn't 3.8 have that huge hole about a month back? I'm also going to assume you've never looked at vB's admin cp.
^This. It seems to me that vBulletin at this point is the only guys that don't get their security audits. Even phpBB and MyBB have been getting them now.
Too much people called it 'vbulletin killer' will make it killed by itself. Just let Kier going with his ideal, to make a new software, not a 'vbulletin replacer'.