Closed source requires a lot of trust in this case.

While source code access is certainly a concern for some, it is worth pointing out that Enpass supports database sync methods such as Dropbox, Google Drive, and a proprietary "wifi" sync. This means that you can have sync like Lastpass or 1Password but retain complete control over your own data.

I can't speak to Enpass's security, but I have been a user for several years. It feels less polished than 1Password but is freer and more open.

That is what I am using. I guess the Enpass attack would require either an attack on the client on my phone / pc or on the storage provider (if they are able to crack my passphrase). I had assumed lastpass and 1pssword were using the same approach

Same