The audit doesn't even seem terribly brutal. Just thorough. I wish every bug report were like this ;) I don't know if this is news to some people, or what, but

The audit doesn't even seem terribly brutal. Just thorough. I wish every bug report were like this ;) I don't know if this is news to some people, or what, but it is usual, when having a product professionally tested, to have the testers test it in earnest, as if it were ready for release. They won't avoid telling you about some obvious hole just because it was obviously accidentally left in and would be a 10 second fix (or whatever - that is just a random example). If you've never been through this before then, presented with a big pile of bugs, it can seem like the project has been proven a total fuckup, and its authors obvious failures, and so on. But in fact, once you've got this concrete list of all the ways in which your program has so far proven itself hopelessly unsuitable for release, it's actually quite surprising how quickly they all get fixed... (Edit - This is more of a general comment than anything specifically about cryptocat)