I have asked around some of the PostNuke Developers who also run E-Smith, and they were satisfied with the security of their sites. I would, however, suggest that you check out postnuke.com and the e-smith-made-to-order.com (I think that is the correct url) site. I hope it helps. I will keep checking and post any findings here and on the postnuke site.
regards,
steve macgregor