I'd maybe argue that "framework" is a bit of a misnomer - Opa is a programming language based on ML (it was originally called MLState) where the compiler determ

I'd maybe argue that "framework" is a bit of a misnomer - Opa is a programming language based on ML (it was originally called MLState) where the compiler determines/enforces what runs on the client or server. It originally compiled down to native code on the server via OCaml as well as front-end Javascript, until the more recent switch to using Node.js on the backend. A lot of the security benefits it offers likely come from the type system (with type inference), probably similar to building a site in Haskell (compile-time errors on unclean strings, type-safe URLs, etc.). Along side of this, it includes a slew of libraries and tools for doing things like authentication, interfacing with specific web services, and building websites, which is why it seems they've started to focus on the "framework" aspect.