[hedora]

I wish people would pay pass (or some other auditable open source software team) for this sort of thing instead.

The situation is particularly painful for security critical software like password managers and disk encryption. Commercial software could be keeping a rot-13 copy of the database on an anonymous ftp server for all I know (or, worse, be written for a leaky JavaScript sandbox).

The open source stuff generally stalls out after the first 90% of the functionality is there, and the second 90% of the work remains.