The press release speaks of "a rigorous source-code security assessment by NCC Group." That suggests more than a bit of url scanning. Somebody is lying, that much is certain.