Perhaps, because the very sensitive nature of this issue, actual security measures are best kept hidden from the public. Still, some reassurance on the matter surely can't hurt

+1. We should make sure they know that this is a high priority issue for us, but for many reasons it's probably best if the actual details of security measures aren't broadcast. If friedcat assures us it's a high priority and they have taken serious measures both to defend themselves and made it so it would be strongly against the best interests of potential attackers to do so, that's good enough for me.