> From the pics it looks like KeePassXC and GIMP run on Haiku? Sweet!

Yep, and for a number of years now, too.

> I wonder how it compares to otto malloc wrt canaries, UAF and so on.

A few of the more performance-affecting features have been disabled, and the global caching layer probably affects at least some of the mitigations too. But many of the checks are still intact, and indeed it's caught a bunch of memory violations in both first- and third-party applications already (though not that many in first-party code, as we did and still do use the guarded_heap system periodically, which is also very good at finding such problems.)

> that insufficient attention is paid to security

Security is not one of our biggest priorities at the moment, no, but it's not totally de-prioritized either. When we notice security issues or get reports of them, we do fix them.

> but I know a lot of improvements have been made.

Yes, there's definitely been a lot of progress in this area over the last 10-15 years. We have a number of the basic mitigations (ASLR, DEP, SMAP, etc.) but there's a lot of parts of the kernel and drivers that haven't been audited to make sure they do all necessary permissions and access checks (though these have been shrinking; I do set aside some time now and again to work on this.)