From my perspective, we've been taking security seriously a year+. Our first commissioned audit was in November 2012, and we've had a bug bounty since then as well: https://crypto.cat/bughunt/

This isn't, of course, to say that there haven't been vulnerabilities. But I have to stand behind our mitigation and disclosure policy as being very highly responsible and transparent.

So far, we've had three paid audits, with two more lined up, and regularly reward community bug-finders. We're planning more competitions for Cryptocat Mobile in March and April, with prizes such as iPhones and Nexus Phones. :-)