Actually I was more referring to the hard work we do to avoid that kind of vulnerabilities by design: http://securitytracker.com/alerts/2010/Apr/1023839.html h

Actually I was more referring to the hard work we do to avoid that kind of vulnerabilities by design: http://securitytracker.com/alerts/2010/Apr/1023839.html http://securitytracker.com/alerts/2010/Apr/1023839.html and http://securitytracker.com/alerts/2009/Apr/1022140.html http://securitytracker.com/alerts/2009/Apr/1022140.html Everything we do we consider security first and do threat modeling. All remote connections are done via TLS, we don't cipher the database on the disk but if there is a demand for it we'll add the feature. We've been extremely thorough to review the code an reduce the possibility for buffer overflows to occur. We use only safe API and validate input thoroughly. Buffers are encapsulated by a class in such a way that unsafe writing is difficult to do. I'm not claiming we'll never have an exploit, just saying we're doing the best we can to avoid it.