I started moving the day LogMeIn acquired them. Lastpass used to have a very open policy of notification for potential security issues and I trusted them as much as one can trust a SaaS vendor. IIRC LogMeIn completely ignored a number of security issues in their applications and refused to acknowledge vulnerabilities.