Hey, I coauthored the audit report you linked to, and I want to clarify: our policy was to list findings without editorializing on how severe you should judge t

Hey, I coauthored the audit report you linked to, and I want to clarify: our policy was to list findings without editorializing on how severe you should judge them to be. We didn't intend to claim one way or another about "a reasonable level of security". I don't speak for Least Authority (and don't currently work for them).