From the top of the article:

Passwork, a Spain-based password manager used by European government agencies and universities, shares technological ties with a Russian counterpart — an arrangement that experts say poses a state-level security risk.

Key findings:

The Russian company, which advertises clients including sanctioned Russian missile manufacturers, has been certified by an agency under the Defense Ministry that requires a deep source-code review to search for “vulnerabilities or undeclared capabilities.” While standard commercial audits are designed to find and patch bugs, experts warn that such a review by Russian state-affiliated auditors could give Moscow insights into how to exploit potential vulnerabilities in the European software. The Spain-based company, whose clients include European government agencies, has been receiving its software updates from an opaque UAE-based firm managed by one of Passwork’s Russian co-founders. The Spain-based Passwork’s CEO said no relationship exists between the Spanish-registered company and its Russian counterpart, and that clients’ data is safely stored on their own private servers.