[ClassyJacket]

But you have to trust them that the secret key never gets transmitted, unless you compiled it yourself.

[Bu9818]

Also, malicious code can be pushed to the website if you are logging in through that. You have to trust that their infrastructure is safe.