I think if you configure and administrate it correctly it is secure.

It is not a binary consideration:

1. Is it inherently insecure? No.
2. Can it be secure? Yes.
3. Is it secure out of the box? No.

Pointless debating this because it is clearly secure* given the case studies and the people/companies/brands/governments/projects successfully using it.

• Given my above caveats.

Also any alternative suggestions will have the same caveats.