From what I&#x27;ve heard, people are generally just concerned that the database is not authenticated whatsoever, and so a malicious actor can modify your database (particularly if it&#x27;s hosted on Dropbox&#x2F;etc...).<p>This doesn&#x27;t seem like a particularly scary vulnerability, but one scenario that was brought up (though I&#x27;m not 100% convinced), is that a malicious actor can corrupt the password for one website, leading you to change the password.<p>I dunno, don&#x27;t see it as a huge vulnerability, but I do agree there is little reason for such a database not to be authenticated.