1 One of the nice things about Minx is that the standard exploits just don't work. (Had to nuke a couple of orphan PHP apps on the mu.nu server yesterday...) 

2 My previous job was with a vulnerability scanner vendor.

I tried looking up exactly which one this is, but I couldn't figure it out rapidly. There are in fact so many directory traversal vulnerabilities that it's hard to narrow it down simply by the URL fragment.

Basically, every web server ever written, every forum program ever written in PHP, and nearly every web app ever written has this directory traversal error in it at one point or another. Very distressing.

(No criticism of mee.nu implied, I'm just making a broad, but quite true, statement. Python at least makes it easier to get right; if you never allow direct file access you have no problem, and if you do need to allow direct file access, using the path modules can help a lot.)

3 I had a directory traversal vulnerability in an early version of Minx, but realised it and did a thorough code review for that.

When I said "standard exploits" I was thinking of scripted exploits, and not the conceptual level. While I think Minx is pretty secure at the conceptual level, I certainly wouldn't claim it's invulnerable. (That would be rather tempting fate...)