All state is updated in the same SQLite file as the program itself.

And now all SQL injection bugs are RCE!

It's a fun idea, though.