dotProject 2.1 is coming closer to realisation. The 2.1 release candidate 2 that I pushed out today is the result of a large amount of effort in cleaning up the codebase and closing off a number of bugs, including some potentially serious security flaws.
I won't be foolish enough to say that we've fixed all security flaws. In a codebase that is now nudging 150,000 lines of code (including third party libraries), you'd have to be an idiot to suggest it was bug free.
You can download from SourceForge and documentation is available at our Status Page on our docs site.