| name | electron-ipc-security |
| description | Use when Electron work adds or audits BrowserWindow privileges, preload APIs, IPC, filesystem, URLs, subprocesses, secrets, permissions, remote content, or CSP. Do not use as a substitute for a full product review, penetration test, feature implementation, or release authorization. |
Electron IPC Security
Treat every renderer-originated request as untrusted local API input.
- Read
references/security-standard.md, references/security-checklist.md,
the sidecar contract, matching backend/integration track, and affected task.
- Inventory BrowserWindow preferences, navigation/window handlers,
permissions, preload exports, IPC channels, filesystem roots, external
URLs, subprocesses, remote content, and secret flows in the task scope.
- Run only evidence-backed repository security commands that actually exist;
otherwise record
NOT RUN and the reason in the task evidence.
- Require narrow capabilities, shared schemas, runtime validation, sender
authorization, allowlists, bounds, cancellation, cleanup, and stable
redacted errors. Add tests for invalid, unauthorized, oversized, cancelled,
traversal, URL, and command rejection paths.
- Attach findings, residual risk, and approved exceptions with owner/expiry
to the backend or integration task. Reopen or block that task when needed.
Never fix a problem by disabling sandbox, context isolation, web security, CSP, validation, or tests. A clean static scan is not a security proof.
