> That's not a long list

It's not the list of top-level pieces of software, it's the amount of code that could have contact with the plaintext or the encryption keys.

> If you don't actually want to test

And build! Don't forget the building itself. It's not so much harder to exploit an app even if all you have access to is its build stage.

----

This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn't be surprised if a security auditor plain refused to touch this because of the sheer magnitude.

And that's without even mentioning it uses npm.

A valid concern for a password manager. This is why I like PasswordStore a lot better for managing passwords and other sensitive information. It is a Bash script that only depends on a very select list of binaries (gpg, git, and tree, if I recall correctly). It is also a script simple enough I can even audit it myself:

https://www.passwordstore.org/

For syncing, either use git, or something like syncthing. It doesn't really matter, because all synced files are encrypted by GnuPG before any syncing tools gets access to it.

You can build without grunt. Grunt just makes the flow a lot easier to manage.

Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem. Even using node.js alone (and no npm, no other libraries) would be extremely hard to audit, simply because of the huge code footprint of v8 alone. But at least I can download all the sources one time, audit it, and be certain every future build with the exact same versions would be safe.

npm doesn't provide even that much guarantee.