electron_audit_security
Audit an Electron app against the official security checklist. Detects 19 security issues from static inputs like BrowserWindow config, main process code, and preload scripts.
Instructions
Audit an Electron app against the official security checklist. Covers 19 of the items that can be detected from static inputs (BrowserWindow configuration, main process code, package.json, preload, HTML): HTTPS-only content, nodeIntegration, contextIsolation, sandbox, webSecurity, CSP, allowRunningInsecureContent, experimentalFeatures, enableBlinkFeatures, raw ipcRenderer exposure, direct window assignment, @electron/remote, supported Electron version, shell.openExternal validation, file:// usage, tag, will-navigate handler, setWindowOpenHandler, and IPC sender validation. The remaining checklist items (session permissions, fuse configuration) require runtime / packaging context and are flagged in the report's footer.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| browserWindowConfig | No | BrowserWindow constructor options as a JSON string or code snippet | |
| mainCode | No | Main process code -- used to detect non-HTTPS URLs in loadURL/loadFile calls | |
| packageJson | No | Content of package.json to check Electron version and dependencies | |
| preloadCode | No | Content of the preload script | |
| htmlContent | No | Content of the main HTML file to check CSP meta tags | |
| electronVersion | No | Electron major version if not in package.json (e.g. '41') |