> the response is not just a statement of belief, but a clear list of changes they intend to implement Sure. But it's also an indication of what their team tho

> the response is not just a statement of belief, but a clear list of changes they intend to implement Sure. But it's also an indication of what their team thought "this is fine!" about, before an internet shitstorm rained down upon them. In my mind they're always to be suspected of being either naive or actively evil in their use of personal data. Anybody who launches "a powerful business tool", and then later tells us "We did not consider potential bad actors. I wholeheartedly apologize for not thinking through this more fully." is not someone I'd want running _my_ business tools. I'm now wondering if they considered "bad actors" finding their open MongoDB databases on Shodan? Or their public S3 buckets with their backups? Or their production API keys and secrets in their pubic GitHub code? Or all those other mistakes that everybody goes "but nobody except idiots would do that!" and yet we read about it multiple times per week anyway... Maybe these guys have a great Email tool. I strongly doubt they have an entrenched culture of "considering bad actors" and appropriately investing effort and securing all the non customer facing infrastructure...