Using GPG means that Password Store is less than 600 lines of bash at its core (minus emacs, completions, so on). <a href="http:&#x2F;&#x2F;git.zx2c4.com&#x2F;password-store&#x2F;tree&#x2F;src&#x2F;password-store.sh" rel="nofollow">http:&#x2F;&#x2F;git.zx2c4.com&#x2F;password-store&#x2F;tree&#x2F;src&#x2F;password-store....</a><p>GPG is maintained, and well. Even as it supports different ciphers, that attack doesn&#x27;t apply here. And very little functionality is accessed through this script.<p>If that&#x27;s not a tiny attack surface, I don&#x27;t know what is.