When auditing an Electron + Node.js application for security vulnerabilities, check each dimension below. Cite file:line for every finding.
contextIsolation: true in all BrowserWindow configsnodeIntegration: false in all BrowserWindow configswebSecurity: true (NOT disabled)sandbox: true if the renderer doesn’t need Node.jscontextBridge.exposeInMainWorld (not require in renderer)eval() in renderer processnew Function() in renderer processwill-navigate handler)webview tags are not used (or are properly sandboxed)any leaking)console.log, logger.* calls)ps)***)eval or Function constructor in dependencies (check npm audit)pnpm audit)* versions in dependencies (all pinned or ranged)| Level | Criteria |
|---|---|
| Critical | Could lead to data exfiltration, RCE, or privilege escalation |
| High | Could lead to unauthorized access, data leak, or DoS |
| Medium | Violates security best practices, limited impact |
| Low | Informational, defense in depth recommendation |
| Verified Secure | Checked and confirmed safe — documents due diligence |