I used to use PuTTY as my go-to windows SSH client. After some time I decided to integrate a piece of software with Pageant and I decided to open up the source

I used to use PuTTY as my go-to windows SSH client. After some time I decided to integrate a piece of software with Pageant and I decided to open up the source to PuTTY. The poor quality of the source code terrified me, it seemed sort of "all over the place" and there seemed to be little to no concern for security and defensive programming. Secure software design and development is what I do for a living, so perhaps I am a bit more paranoid than the casual user - but this is one of the most widely deployed security tools in an enterprise, this shouldn't be "okay". Some defensive efforts are just common sense and are recommended by your compiler (eg. don't use sprintf and strcpy when you can snprintf and strncpy). Also, it doesn't hurt to check error conditions consistently. PS. To echo what a lot of folks have already said, how on earth can the author implement cryptographic algorithms and simultaneously think there is any value in publishing a hash of the binary "for security". Using a hash as a means of integrity validation in the context of security raises huge red flags about the authors mindset.