A password manager tied to European public sector use is now under scrutiny over shared code lineage and update relationships that raise procurement and supply-chain questions.