“Ginny!" said Mr. Weasley, flabbergasted. "Haven't I taught you anything? What have I always told you? Never trust anything that can think for itself if you can't see where it keeps its brain!”
As relatively security-literate users of an app where we'd be putting personally identifiable information or other details we don't want getting out, it stands to reason we want to see a history of commits on an open source project and a history of security audits and preferably be able to refer to RFC's for the algorithms and protocols used.
Unless you guys open source and publish audit details, it's not worth my time to consider this product. No disrespect meant, it's just common sense.