the issue isn't that a user can be convinced into running `console.log(“<script>hackMe()</script>”)` but that `console.log(creep.name)` may execute hackMe() without you expecting it.
but that is part of the problem: this isn't clearly communicated to the end user in the future or present.
Current users will have their install broken and need to google to figure out what is going on.
Future users will install `keepassxc` thinking it would be actually KeePassXC before potentially realizing its a minimal version.
Personally I think splitting it into `keepassxc-full` and `keepassc-minimal` would be better since it moves the choice to the user instead of implying the contents.
- getting the favicon for a specific entry (needs to be ran manually with an option to download via a DuckDuckGo proxy)
- checking entries against HIBP (needs to be done manually in a submenu with a giant notice)
Also this is about KeePassXC not KeePass which is a completely different project.
There is also KeePassX, KeePassDX, KeeWeb, KeePass-electron and so on and so forth.
I find this to be really interesting advise but I wonder when this is right and when this would be wrong.
Especially in C, where a lot of data is passed through pointers, you'd want to make sure the data you are given isn't pointing to nothing and can't always rely on the callee doing it for you.
I mean, yeah, you don't need the whole GTK library for titlebars, but you still need to drag libdecor along to support a subgroup (Wayland users) of a subgroup (Gnome users).
Its pretty annoying to add another moving piece to the machinery just to do that.