I was intrigued by the claim that they are secure by virtue of their patented tech, so I looked up the patent https://patents.google.com/patent/US9906369B2 htt

I was intrigued by the claim that they are secure by virtue of their patented tech, so I looked up the patent https://patents.google.com/patent/US9906369B2 https://patents.google.com/patent/US9906369B2 Sounds like a trust on first use scheme so that you get a public key from the distributor, and use that to verify the application bundle on subsequent use. I actually do like this because it solves for a paranoia I have with password managers, in that they can claim all they want that decryption happens clientside but they're serving me a JavaScript bundle and how am I supposed to believe that isn't changed on the fly via supply chain attack? So at least this adds a step that the application code that is delivered from the server must be signed by the author. Edit: client is source-available (nonfree), I actually hadn't come across npm verify, so thanks for that https://github.com/cyph/cyph?tab=License-1-ov-file https://github.com/cyph/cyph?tab=License-1-ov-file