Password Store might be tiny but GPG itself is a huge attack surface - that&#x27;s the problem.<p>Maintained, yes, well... I&#x27;d question that. I don&#x27;t think it&#x27;s very heavily reviewed or anything, and vulnerabilities pop up in it quite frequently, enough that I&#x27;m uncomfortable using it for serious purposes.<p><a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-4711&#x2F;Gnupg.html" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-4711...</a><p>Many of these vulnerabilities have to do with very important cryptographic code... If you&#x27;re comfortable with it, that&#x27;s fine, it&#x27;s not a bad solution. But personally I&#x27;d honestly be more comfortable with plain text files and TrueCrypt, which has no real cryptographic problems even after quite heavy review, the best we&#x27;ve found is a privesc bug in the Windows driver.