All Horde software is developed with strict coding standards and under continuous peer review. It's in development for 7 years and being reviewed for security issues by user, administrators, security experts and developers constantly.
We have active measures against common web application flaws like session fixation and cross site scripting. The following list of measures makes no claim to be complete:
The only piece of code that needs regular updates to fix XSS holes is the HTML MIME viewer that is used to view HTML messages in IMP. The reason is that people still find new ways to trick browsers, especially Internet Explorer, to execute script code every other day. Thus this viewer is disabled by default. Our filter is still one of the best available though, so other projects are using it in their applications too.