Embed Notice

@atoponce @dimpase That is not what we call a "vulnerability", rather behaving correctly (not trying to lock the user's own data away from them in hidden storage they can't find, inspect, or backup).

It's arguably a "lack of hardening", but the hardening doesn't belong at this layer. If user needs protection against physical seizure, they use FDE and strong passphrase. If they need protection against malicious local apps, they run those on a different account or in a sandbox.