In reply to MCouch.

I'm sorry we didn't send you a shot glass: https://www.dropbox.com/s/ld41yodogmd5o9a/2016-09-07_06-08-02.png?dl=0

In all seriousness though, security is a big deal. Especially in a form plugin where your main function is to collect random user data. That being said, I'm proud of our track record where security is concerned.

We've invested to have other teams help audit, but sometimes things still show up. When discovered or reported we patch same day. Usually within hours. The very few times where we didn't patch same day was when we were organizing with the .org team to push releases to affected sites and/or because the same issues was in dozens of other plugins and we were coordinating a release.

Once more, about a year or so ago, we discovered a security issue that was shared by most every form plugin available. We quietly reached out to all of them to make the issue aware so they could all patch their plugins as well.

We're not perfect, but we are alert, responsive, and dedicated. We don't always get it right, but we always MAKE it right.