@GrapheneOS @ADHDruid @jonny
Yes I fully understand the different environments and threat models between a browser sandboxed web-app, and an android native app.
What I'm trying to say is that the average user is just going to see you dismissing what they might feel is valid concerns (whether they are valid or not is irrelevant) and feel disgruntled towards the project.
What you're saying isn't "we don't think this is a concern" or "this doesn't fit the threat model grapheneos is designed against". What you're saying is "we don't think this is *enough* of a concern for us to fix". It would have been much better PR to just say "your concern has been acknowledged" and silently shove the feature request in the "TODO-2034" pile internally, if you do anything at all.