Hacker News Reader

What are the security concerns with something like this? Can PWAs contain malicious code? If yes, what can they do?

A PWA is nothing more then a glorified web site, which opens full screen.

Security-wise, they cannot do anything worse then a website can. In other words, this is _less_ then a native app can do.

Anything your browser can normally do with permissions allowed to domains by you.