Fly have https://news.ycombinator.com/user?id=tptacek working for them so it's hard to imagine they would get security wrong.