Somewhere in the #sway docs it says that they're not particularly focusing on security right now, and may improve it later, but in worst case sway won't be more insecure than Xorg. Well... with Xorg, can an app prevent some key binding from reaching the WM? On sway, every tooltip or other borderless popup does that. Or maybe it was possible on Xorg too, just not easy to do accidentally. In which case it's a matter of robustness. @sir will wlroots change this behaviour?