electron-dev

# Electron desktop development Patterns and practices for building production-quality Electron applications with React and TypeScript. ## Security baseline (Electron 30+) Electron's defaults have hardened over the past several releases. As of Electron 28+, `contextIsolation: true` and `sandbox: true` are the defaults for new BrowserWindow instances, most security advice from older guides assumed you had to opt in. You don't anymore; you have to opt OUT, and you should not. Set explicitly anyway, so a config drift never weakens the security model: ```javascript const win = new BrowserWindow({ webPreferences: { contextIsolation: true, // default since 12, mandatory for any prod app sandbox: true, // default since 28; renderer runs sandboxed nodeIntegration: false, // never enable in renderer webSecurity: true, // never disable preload: path.join(__dirname, 'preload.cjs') } }); ``` Validate every IPC message in main. Don't trust the renderer. ### Electron Fuses + ASAR integrity Electron Fuses are package-time toggles baked into the binary. The two relevant for security distribution: - `EnableEmbeddedAsarIntegrityValidation`, verifies the app.asar hash at runtime against a hash embedded in the binary. Defends against attackers swapping the asar contents post-install. - `OnlyLoadAppFromAsar`, refuses to load app code from anywhere except the validated asar. These are **opt-in**, not default. Enable both...