NotchNotify needs Accessibility permission, which lets it read and move other apps' windows. Please report anything that could let it, or something abusing it, go beyond reading and moving Notification Center banners.

Report vulnerabilities privately through GitHub security advisories rather than in a public issue. Only the latest release receives fixes.