&gt;  That&#x27;s not a long list<p>It&#x27;s not the list of top-level pieces of software, it&#x27;s the amount of code that could have contact with the plaintext or the encryption keys.<p>&gt; If you don&#x27;t actually want to test<p>And build! Don&#x27;t forget the building itself. It&#x27;s not so much harder to exploit an app even if all you have access to is its build stage.<p>----<p>This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn&#x27;t be surprised if a security auditor plain refused to touch this because of the sheer magnitude.<p>And that&#x27;s without even mentioning it uses npm.