I found your issue about this: https://github.com/justwatchcom/gopass/issues/462

It sounds serious, for sure, and this software deals with sensitive data, so that is important to keep in mind (though, it versions with Git, so that's a nice safety). I just want to point out how responsive they were in your issue: it appears there was a fix merged in less than a day later!