Earlier quoted context omitted.
Yev from Backblaze here - with sincere apologies. After we removed the offending code on Sunday night we went into investigation mode and conducted a rca - we wanted to get some kind of blog post out there so that folks could see that we were working and investigating the issue. I will grant you that maybe our initial execution on that was lackluster, but we wanted to make sure we had a better handle on what we were…
> We are also reviewing applicable third party code on the website. This is very simple. On all dashboard and similar signed-in pages, there's exactly zero applicable third party code. If you think otherwise you do not in any way take "the privacy of our customers’ data and personal information very seriously". As such, you should be much more specific about what you mean with "we removed the offending code". If you…
We also subsequently removed Google Tag Manager from the private pages.
This is good. However, the question then becomes how on earth did Google Tag Manager get added to those pages to begin with?
Either you did not consider this a cause for concern, or it slipped past your code review. In either instance, how could I ever trust you with my data?
That question needs a serious answer.