> This isn’t really a reasonable request. You can do any of this yourself as well, so your assurances are your own. If you want someone else to own those assura

> This isn’t really a reasonable request. You can do any of this yourself as well, so your assurances are your own. If you want someone else to own those assurances you need to pay up. Sure it is. This is what third party security audits exist for. For example: https://www.hashicorp.com/solutions/auditing-and-compliance https://www.hashicorp.com/solutions/auditing-and-compliance This isn't unique to Hashicorp. Any organization which claims to offer secure protection should be willing to share this kind of information. https://docs.securedrop.org/en/stable/what_is_securedrop.html#audits https://docs.securedrop.org/en/stable/what_is_securedrop.htm... https://threatpost.com/openssl-security-audit-ready-to-start/111538/ https://threatpost.com/openssl-security-audit-ready-to-start... The point here is not "we pay more money and get better security." That's the kind of garbage logic the SSL CA cabal used for decades to maintain a monopoly before LetsEncrypt showed up. The question is, what is an indication that, although there is clearly some drama, that I can trust the software with my secrets? Did some of the people come to this new project from the Hashicorp security team? Could it be that the majority of changes in codebase are on the UX/UI, and not the security protocol implementation? There are plenty of ways to publish trust validation without demanding that a potential user spend hours poring through code looking for exploits.