They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ h

They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pdf https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...