Okay, who? And why should I trust them? How do I know they didn't sign an NDA promising to keep any security vulnerabilities secret?