They are actually know what they are doing. I think they have a full time security guys and also have a bug bounty as others have mentioned.