Author here :) This is definitely a good concern to have, though Espanso was built with security in mind, so the keys you press are not logged anywere. We keep the last N in memory (with N being usually between 5 to 30 chars) to do the matching, and discard them as soon as possible