I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android).
I basically refuse to use any password manager with an implementation I can't see or audit.
I can't imagine trusting any company to handle my passwords correctly.
The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would cause me to lose control over my passwords unless I lose control over the yubikey itself.
That's a fair point. I certainly haven't.
But the great virtue of pass is that it runs locally, which means that it's much more difficult to attack than a SaS password manager.
I haven’t in all honesty read the Password Store android application (nor OpenKeychain) source code but I trust my phone sandbox capabilities enough for it not to do anything nefarious like send my passwords somewhere. Its also not so large that it would be hard to read it.
The point is, the operating principles behind how Pass works are simple enough that its relatively easy to verify the core of any implentation and relatively difficult to smuggle in nefarious behavior.
Maybe you haven't heard of pass[1], but it's an open source project, and it's easy to build from source[2].
---