In my view, security isn’t a feature, it’s a design choice.

I have no ill wishes towards Stoat, but I’ve never seen a developer convincingly implement security after the fact.