% tail /etc/chromium/unveil.main
[snip] # KeePassXC /usr/local/bin r /usr/local/bin/keepassxc-proxy rx
If you don't have the /usr/local/bin unveil, it will not properly detect the proxy plugin. (There's an assertion in the source prior to the exec that getcwd must exist, which is invoked in /usr/local/bin.)

