Cryptography engineers have a duty of care to their users that many are failing to meet. Three case studies illustrate the problem: insecure AES implementations in aes-js/pyaes with cavalier developer responses, a research paper eviscerating LastPass, Bitwarden, and Dashlane's cryptographic security, and Matrix's dismissive response to disclosed vulnerabilities. The core failure is that most cryptographic software lacks clear threat models, vague security goals, and poor transparency about maturity. A minimum bar is proposed: write obviously secure ('boring') code, state security goals and assumptions explicitly, and be transparent about project maturity. Being open source does not absolve developers of responsibility when their cryptographic code is widely adopted.
