Ack. Thanks for the points. Un-packing a few things: 3. Definitely — We're working to cut our dependencies in the coming months. Most existing dependencies (th

Ack. Thanks for the points. Un-packing a few things: 3. Definitely — We're working to cut our dependencies in the coming months. Most existing dependencies (the backend at least - I focus more on this area) we stick to those widely used and those essential to the platform; there're also certain dependencies directly linked to integrations with third-party platforms (e.g. AWS, Octokit - GitHub, etc.). 4. We'll definitely take a look at this — This is on our immediate roadmap as well. We had a few ideas in mind related to a mix of components in browser-memory, session-storage, etc. as well but wanted to make sure we get it 100% right before deploying any changes - based on recommended practices like from Auth0. This article may be relevant: https://auth0.com/docs/secure/security-guidance/data-security/token-storage https://auth0.com/docs/secure/security-guidance/data-securit... 5. We actually did evaluate both PKDF2 and Argon2id options in addition to seeing what other secure platforms are doing. We found most to start out with PKDF2 but overtime to introduce support for Argon2id — Take Bitwarden and Dashlane as two examples of this; Bitwarden of which introduced it as of only a few months back. This article may help: https://soatok.blog/2022/12/29/what-we-do-in-the-etc-shadow-cryptography-with-passwords/ https://soatok.blog/2022/12/29/what-we-do-in-the-etc-shadow-... The choice of Argon2id KDF is sound and recommended; we have it with memory cost of 64MiB, ops cost of 3, and parallelism of 1. 6. argon2-browser is still used well and reliably throughout the ecosystem — take Bitwarden as the biggest example of a solution recently making the switch to use it. Anyways, happy to move this discussion to email!