Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag.

The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo.

The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw).

I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.

- No https, agree, its a very old site, but it's not sensitive material that you're submitting. You can check the integrity of the download [0]

- Sourceforge, again not ideal but again it has very old beginnings from when Sourceforge was as respected as Github is. You can't blame the developer for the environment changing. Perhaps they're just a stickler for loyalty. I've never had any crapware with Keepass

- FAQ - I could't find your reference in the FAQ page [1]

- You have one app + plugin with a browser extension from two developers, hardly a mishmash. You know directly who those two developers are. You've no idea who was working on LastPass. I'd say it was more in the bazaar philosophy vs the LastPass cathedral.

  [0]: http://keepass.info/integrity.html
  [1]: http://keepass.info/help/base/faq_tech.html

You can download the file via https [0], this is what the Chocolatey package does [1]

  [0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.35/KeePass-2.35-Setup.exe
  [1]: https://chocolatey.org/packages/keepass