@llogiq
And so am I! This is why access is only bound to local ports and the access has to be confirmed by the user. Furthermore, you need to know exactly what you want to exfiltrate (path and name of username and secret). This way, I hope to minimize this risk nearly to the point of having an unlocked vault in a running KeePass instance. If the attacker is already in your machine, things become salty... This mechanism is basically also used by others password managers like there 1password cli.