Please don't report security problems in a public issue. Email Kaleb@voltare.us with what you found and how to reproduce it, and you'll get a reply.

Keep in mind how Mac.apk works: an Android app running under Mac.apk is ordinary native code with your macOS user account's permissions. There is no phone-style sandbox around it, so "an APK can read my files" is expected behaviour, not a bug. Only install APKs you trust.