Ouch!

I'm not eager to review this one - also because that one above was just a random vuln I checked on the spot because I remembered it from 2 weeks ago or so - I think imma do a pass on this. I also don't understand why you would take the supply chain risk of having breez sdk in your secure messenger. All that ffi, bridges and cargo hell... <what can possibly go wrong>? I already cry every time i have to do signal (kotlin)->ringrtc (rust)->webrtc (c++) review, which is about every other release, meaning 3x per month or so.

This "integrated payments" feature is something I'll probably never understand though. I don't want my money exposed to a thing that literally takes crap in from outside, or my confidential messages exposed to SDKs that interface with public networks. Sandboxing is a thing.