As someone who works in infosec, this doesn't surprise me at all. I've tested many applications which claim to be secure, designed for security/privacy sensiti

As someone who works in infosec, this doesn't surprise me at all. I've tested many applications which claim to be secure, designed for security/privacy sensitive tasks, yet are very easy to compromise (simple OWASP top 10 stuff). Even if the app developers are great and know their stuff, I can still see them slipping up on the distribution. It's normally handled for most developers and is outside the realm of any secure development guidelines they might be following.