electron-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/electron-security/SKILL.md. --> # Electron Desktop Security Harden Electron: renderer trust boundary (nodeIntegration, contextIsolation, sandbox), build-time fuses, contextBridge and IPC allowlists, shell.openExternal, navigation guards, deep-link auth, safeStorage. Use when generating main-process code, a preload script, or custom-protocol handlers, when packaging a release, or when storing tokens in an Electron app. ## ALWAYS - **Treat the renderer as untrusted.** Any renderer-side code execution — XSS in rendered content, a redirect, a deep link — must not be able to reach Node, the shell, the filesystem, or session tokens. Every other rule here follows from this one, and every IPC sink you expose is reachable from a compromised renderer. - Keep the renderer's process isolation at its defaults rather than restoring them: `nodeIntegration: false`, `contextIsolation: true` and `sandbox: true` have been Electron's defaults for several major versions, so the finding is the line that **turns one off**. Note the coupling: under `sandbox: true` a preload gets a polyfilled module subset, so a preload needing `fs` fails — move that work behind IPC into the main process, never drop the sandbox. - Set the packaging **fuses** on release builds: disable `RunAsNode`, `EnableNodeCliInspectArguments` and `EnableNodeOptionsEnvironmentVariable`