They have an API where you can write your own client, if you don't want to use the JS client. This doesn't solve every security problem, but at least this one.

They have an API where you can write your own client, if you don't want to use the JS client. This doesn't solve every security problem, but at least this one. I think that they have really tried to make it secure, but they aren't just competent enough. Browser-crypto is always somewhat insecure especially when they actually store your keys and you have to trust them.