Security issue? App has full access to all files and folders as well as removable volumes even when not added to Security & Privacy

[CuteBaby]

In System Preferences > Security & Privacy > Privacy, there are two sections labeled 'Full Disk Access' and 'Files and Folders'. Apps that are not listed in those sections are not supposed to have access to all files and folders nor removable volumes.

However, I have come across an app (Discord in this case) that is not listed in the above sections, yet appears to have full access to all files and folders as well as removable volumes. I tested this by trying to change my Discord avatar pic by selecting pics located in the Downloads folder, Documents folder and an external drive, and Discord was able to load and show a preview of the pic inside the app each time!

What is going on here? Why does Discord have full access to my data without my consent? If Discord can do this, can't any other app?

 

[galad]

That's normal, the restrictions apply only to file access the app try to read or write without using the standard Open panel.
If the files access goes manually thru the Open Panel (which is run safely by macOS in a separate process) or thru drag & drop, then you give yourself the access to a specific file or folder to the app.

 

[CuteBaby]

Thanks for the info! Definitely brings some relief, but also some questions:

1. Do you mean that if you select a file manually via the Open panel, macOS allows the app to access that specific file, even though the app continues to be unable to access the folder containing that file?

2. Is it a one-time access or does the app now have unlimited access to that file from then on? If unlimited, how do you view the full list of allowed files/folders so you can revoke access?

3. If you were to rename the file, would the app have access to the renamed file?

4. If you were to replace the file with a new file that has the same name, would the app have access to the new file?

 

[galad]

1. Yes
2. 3. 4. I don't remember how it's implemented for non sandboxed app, but I think the app will continue to have access to the file, but I don't think Discord keeps track of the files it can access.

 

[CuteBaby]

OK — thanks again! 👶🏻