[spzb]

I had a play with it using mitmproxy and one thing is for sure, it doesn't implement certificate pinning. It happily connected to my self-signed certificate. When you set a master password for access to your Mac it's sent to their server (a Cloudflare Worker) as plaintext (albeit over TLS) rather than using it as input to a key derivation function. That makes me think it's probably stored server-side with little to no security. All in all, there ain't a bargepole long enough for me to touch this with.

[Sayuj01]

You are absolutely wrong on the storage claim, the server runs proper PBKDF2-SHA256 with 100k iterations and a random salt, so that part is solid.

[spzb]

And I have absolutely no reason to trust that claim.