Secure by design

Odoo is designed in a way that prevents introducing most common security vulnerabilities:

• SQL injections are prevented by the use of a higher-level API that does not require manual SQL queries

• XSS attacks are prevented by the use of a high-level templating system that automatically escapes injected data 

• The framework prevents RPC access to private methods, making it harder to introduce exploitable vulnerabilities

Reffernce link : https://www.odoo.com/security