In https://github.com/SirCmpwn/sway/blob/master/sway/main.c#L159 there is a call to setgroups before setuids. There is a high probability this means it didn't relinquish all groups, and this would be a potential security issue to be fixed. See https://www.securecoding.cert.org/confluence/display/c/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges
In https://github.com/SirCmpwn/sway/blob/master/sway/main.c#L159 there is a call to setgroups before setuids.
There is a high probability this means it didn't relinquish all groups, and this would be a potential security issue to be fixed.
See https://www.securecoding.cert.org/confluence/display/c/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges