[imp] security of IMP - I need documentation

[scott]

I am interested in promoting the use of IMP at my company, where we
currently use OWA (but not to the outside).  The company wants a
web-based email client on the Web.  One of the things I need to produce
is evidence that Horde/IMP is more secure than opening up OWA to the
Internet. I can find exploits that have affected OWA, but where can I
find security-related info about IMP/Horde?  

Thanks,

Scott Henderson