> This means that when "/usr/bin/firefox" sets a "passwords:superwebsite.com = animebooba", an app called "~/Downloads/totally_legit.sh" can not see ...

It will be interesting to see how it treats symlinks in this case. Or specifically, will this idea break completely for nixos or not.