Windows holds the Accessibility permission, which lets it read and move the windows of every app and read their menus, and it watches the mouse globally to detect a drag. A bug in any of this can expose someone's data or hand that power to something else, so please report it privately.

How: open a private security advisory on this repository. Please don't open a public issue for it.

What helps: the macOS version, the steps, and what was read, moved or exposed.

You will get an answer within a week. Once a fix ships, the advisory is published with credit to you, unless you'd rather stay anonymous.

Supported: the latest release only.