> But flatpak has it sandboxed so the worst you could do is maybe steal my Spotify session token. It has access to X11 <https://github.com/flathub/com.spotify.

> But flatpak has it sandboxed so the worst you could do is maybe steal my Spotify session token. It has access to X11 <https://github.com/flathub/com.spotify.Client/blob/0856c76419e37c2ed5113f0b4af3068676d2da53/com.spotify.Client.json#L13 https://github.com/flathub/com.spotify.Client/blob/0856c7641...>, so it could also be running a keylogger.