Developing applications using Tapestry provides some modest security benefits.
Tapestry applications are built on top of the Java Servlet API, and so inherits all the sercurity benefits of servlets. Most security intrusions against CGI programs (such as those written in Perl or other scripting languages) rely on sloppy code that evaluates portions of the URL in a system shell; this never happens when using the Java Servlet API.
Because the URLs created by Tapestry for processing client interaction are more strongly structured than the URLs in traditional solutions, there are fewer weaknesses to exploit. Improperly formatted URLs result in an exception response being presented to the user. Tapestry URLs are also harder to spoof, since they are very conversational ... the exact form of the URL is dependent on any or all of the previous interactions between the client and the server in the same session.
Where the Java Servlet API suffers is in client identification, since a session identifier is stored on the client either as an HTTP Cookie or encoded into each URL. Malicious software could acquire such an identifier and "assume" the identity of a user who has recently logged into the application. Still, because of the conversational nature of the Tapestry URLs it would be difficult for an automated intruder to progress through the application from that point.
Finally, Tapestry applications have a single flow of control: all incoming requests flow through a few specific methods of particular classes. This makes it easier to add additional security measures that are specific to the application.