Thanks for sharing that I'll definitely check it out, though, I'm still not sure where there is compromise here.

There'd need to be an attacker with physical access to my machine conducting a buffer overflow to try and pull out the keys from memory. Or more likely, the email of the target is comprised in some way.

Other than those scenarios, I don't see how the key could be extracted by a bad actor during the mining -> email process?