EDIT: I revisited the code. Looks like everything in [1] is fixed, nothing in [2] is fixed, there are now JWTs for some reason, and… they removed metadata encryption??[3][4] Or it was never in in the first place and simple-crypto-js was used for something else? Either way, it’s a current and major flaw.
[1] https://news.ycombinator.com/item?id=22587940
[2] https://news.ycombinator.com/item?id=22582570
[3] https://github.com/lesspass/lesspass/issues/185
[4] https://github.com/lesspass/lesspass/blob/314fc7386f2c29750c...
I recommend checking out their main page - it's got plenty of screenshots that showcase all the important features:
in all seriousness, Lesspass has a cool concept (I hadn't heard of them before, just looked at their website now). I'd be interested in hearing what cryptography/security experts think about it.