secure-electron-template

Needless self-promotion; this is why I came up with this template, to build secure electron apps. It is obvious that current industry has not caught up with secure practices for Electron apps, and I hope this template can help people in their endeavors. https://github.com/reZach/secure-electron-template *contextIsolation is turned on in this template, so the RCE as described in the article is prevented.

Thanks for offering to contribute to open source! I own the secure electron template open-source library. It's a template for building secure electron apps. There are a few low priority issues if you'd like to work on them. Otherwise, there are various dependencies such as context menus, i18n support, etc that could use new features if you want to think of some that could be useful. https://github.com/reZach/secure-electron-template

Your concerns about security with regard to Electron apps is real. So much so that for the new project I'm working on, I spent a few months building https://github.com/reZach/secure-electron-template, which is an OSS secure electron template that fixes up the security holes so you don't have to worry about it.

Go and proceed where your heart leads you. Just dive in. I can only speak of myself, but if you are interested in security and haven't gave Electron a try, I've written an open source template that could be improved upon: https://github.com/reZach/secure-electron-template Oh, and be sure to cover your mouth if you cough! (And politely yell at people who cough in their hands :) )

It's a great idea to have a template for writing secure Electron apps, but this particular template should only be used with caution. I don't think it has been reviewed or endorsed by the Electron team as actually following those best practices, and I see a few issues just skimming from my phone: They're trying to expose IPC to the renderer in an unsafe way. See their discussion on this GH issue https://github.com/electron/electron/issues/21437 (referenced from the main readme as blocking some features they want to implement) On their "building a secure app" page they complain about Electron's quick release cadence https://github.com/reZach/secure-electron-template/blob/mast... > The trouble that I've found with electron, is that their release schedule is crazy, with only a few months before each major release. We know that electron is a