That said, the German Federal Office for Information Security, the government body responsible for IT security in Germany, recommends keepass. This doesn't guarantee that there are no problems, but it helps. Everybody can inspect the source code and look for problems. It has a secure copy/paste function that deletes it.

When the US was looking for a replacement of the aging Data Encryption Standard (DES) it called for an open competition where the proposed replacements where scrutinized by cryptographers from around the world. The database itself is encrypted, it has the ability to generate secure passwords based on your preferences. If you can prevent those + some less prevalent ones, its safe, but if you cannot, i would not risk it. It is vulnerable against: physical access malware basically anything that can access your computer. Moreover in case of an open source plugin, you cant be sure the PLGX file you downloaded really correspond to the public available source code. The only problem is that some of them are open source, some others are not. This approach is often called 'security by obscurity' and is generally frowned upon by security professionals. When you have it open, it is as safe as the computer, especially if you dont have auto lock enabled. So in short, the only way to ensure an optimum security with the KeePass plugins is to review their codes by yourself. Keeping the source closed doesn't improve the security of a software project.

Keepass is safe