In my opinion, security is more of a result of your information flow and API input /output. So using express or hapi should not make a big difference when it comes to security.