A private line to the engine
The window and the engine behind it now talk through a channel only your macOS account can open, private from the first instant.
Out of the shared folder
Bandicot's window talks to its engine through a local socket. It used to sit in /tmp, which every account on the Mac shares. It now lives in your account's own temporary folder, which no other account can enter.
The socket is created readable by you alone, with no moment in between when it is open, and Bandicot refuses to start if it ever is not. Sockets left behind by older versions are cleared on the next start.