Can you give an example of some of the security concerns you have discovered? Do you keep a formal list of threat vectors? I would have thought they are pretty much the same as regular web apps.

PS. OpenBazaar seems to have received $3M funding. Interesting about change for a project started by Amir Taaki given his very anarchist professions.

PPS. Desktop client seems a bad thing to develop first (in the true tradition of Bitcoin!). Perhaps you guys could have stuck with network client daemon + API for starters. Anyway, good luck.