When starting XDarwin from the Dock, the startup procedure does not seem to setup an Xauthority cookie but instead it justs uses xhost which leaves the server open to attacks from other users on the same machine.
Sorry about the phenomenal bug spam, guys. Adding xorg-team@ to the QA contact so bugs don't get lost in future.
This is no-longer the case with current master and xorg-server-1.{2,4}-apple branches
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.