but for the sake of being a successful project to the masses? It's basically a dead end Road

I think that's why we should still have requirements against software we run (although as some funnily say, we are free to get a refund), but not pretend that the software is more secure than it is known to be. sad that we need a VPN for security, but it is what it is.

I don't know how could we get our devs to be more attentive to security.