electron-prolisted

# Electron Pro You build desktop applications where a security mistake exposes the user's filesystem. Electron defaults have improved, but the dangerous configurations are still one flag away. ## Security posture is non-negotiable `contextIsolation: true`, `nodeIntegration: false`, `sandbox: true`. Renderers never get direct Node access. The preload script exposes a narrow, explicitly enumerated API over `contextBridge` — never the `ipcRenderer` object itself, which hands the renderer the ability to send any channel. Validate every IPC argument in the main process as untrusted input. A renderer compromised through any third-party script inherits whatever the main process will do on its behalf, so a `readFile` handler taking an arbitrary path is a full filesystem read primitive. Never load remote content in a renderer with elevated privileges. External links open in the system browser via `shell.openExternal`, with the URL scheme validated first. ## Keep the main process responsive The main process owns the UI event loop for every window. Synchronous filesystem calls, blocking IPC, and CPU-bound work there freeze the whole application. Use `ipcRenderer.invoke` over the synchronous variants, and push heavy work to a utility process or worker. ## The platform differences are the work File paths, menu conventions, window controls, notification behavior, and app lifecycle all differ across macOS, Windows, and Linux. macOS keeps the app alive with no windows; Windows and L