Attacker JS in renderer
   │  blocked by → sandbox (no Node, OS-level process sandbox)
   │  blocked by → contextIsolation (cannot reach preload internals)
   │  blocked by → narrow contextBridge API (only the functions you exposed)
   │  blocked by → IPC argument validation in main (untrusted input)
   │  blocked by → CSP (cannot inject/eval new code)
   ▼
OS / filesystem / network  ← should never be reachable directly

import { BrowserWindow } from 'electron'
import path from 'node:path'

const win = new BrowserWindow({
  webPreferences: {
    contextIsolation: true,   // default true  — keep it
    sandbox: true,            // turn it ON    — strongest isolation
    nodeIntegration: false,   // default false — never enable for remote content
    nodeIntegrationInWorker: false,
    webSecurity: true,        // default true  — never disable
    allowRunningInsecureContent: false,
    preload: path.join(__dirname, 'preload.js'),
  },
})

// preload.ts — GOOD: specific, intention-revealing functions
import { contextBridge, ipcRenderer } from 'electron'

contextBridge.exposeInMainWorld('api', {
  // Each function maps to ONE known, audited operation
  loadProfile: (userId: string) => ipcRenderer.invoke('profile:load', userId),
  saveNote: (note: { id: string; body: string }) =>
    ipcRenderer.invoke('note:save', note),
  onUpdateAvailable: (cb: () => void) => {
    const handler = () => cb()
    ipcRenderer.on('update:available', handler)
    return () => ipcRenderer.removeListener('update:available', handler)
  },
})

// preload.ts — DANGEROUS: never do this
contextBridge.exposeInMainWorld('api', {
  // Lets the page invoke ANY channel with ANY payload — total bypass
  invoke: (channel: string, ...args: unknown[]) => ipcRenderer.invoke(channel, ...args),
  // Hands raw Node power to the page
  ipcRenderer,
  readFile: (p: string) => require('fs').readFileSync(p),
})

// main.ts
import { ipcMain, app } from 'electron'
import path from 'node:path'
import { promises as fs } from 'node:fs'

const NOTES_DIR = path.join(app.getPath('userData'), 'notes')

ipcMain.handle('note:save', async (_event, note: unknown) => {
  // 1. Validate shape (use zod/valibot in real code)
  if (
    typeof note !== 'object' || note === null ||
    typeof (note as any).id !== 'string' ||
    typeof (note as any).body !== 'string'
  ) {
    throw new Error('Invalid note payload')
  }
  const { id, body } = note as { id: string; body: string }

  // 2. Prevent path traversal — id must be a plain identifier
  if (!/^[a-z0-9_-]{1,64}$/i.test(id)) throw new Error('Invalid id')

  const target = path.join(NOTES_DIR, `${id}.json`)
  // 3. Confirm the resolved path stays inside the allowed directory
  if (!target.startsWith(NOTES_DIR + path.sep)) throw new Error('Path escape')

  await fs.writeFile(target, JSON.stringify({ id, body }), 'utf8')
})

// main.ts — set CSP on every response for your app's session
import { session } from 'electron'

session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
  callback({
    responseHeaders: {
      ...details.responseHeaders,
      'Content-Security-Policy': [
        "default-src 'self'",
        "script-src 'self'",
        "style-src 'self'",
        "img-src 'self' data:",
        "connect-src 'self' https://api.example.com",
        "object-src 'none'",
        "base-uri 'none'",
        "frame-ancestors 'none'",
      ].join('; '),
    },
  })
})

// main.ts
import { shell } from 'electron'

app.on('web-contents-created', (_e, contents) => {
  // 1. Block in-app navigation away from trusted origins
  contents.on('will-navigate', (event, url) => {
    const { origin } = new URL(url)
    if (origin !== 'https://app.example.com' && !url.startsWith('file://')) {
      event.preventDefault()
    }
  })

  // 2. Deny window.open by default; route trusted links to the OS browser
  contents.setWindowOpenHandler(({ url }) => {
    const parsed = new URL(url)
    if (parsed.protocol === 'https:') {
      shell.openExternal(url) // opens in the user's real browser, not Electron
    }
    return { action: 'deny' }
  })
})

function openExternalSafely(rawUrl: string): void {
  let url: URL
  try {
    url = new URL(rawUrl)
  } catch {
    return // not a valid absolute URL — reject
  }
  if (url.protocol === 'https:' || url.protocol === 'mailto:') {
    shell.openExternal(url.href)
  }
  // everything else (file:, javascript:, smb:, custom schemes) is dropped
}

session.defaultSession.setPermissionRequestHandler((_wc, permission, callback) => {
  const allowed = new Set(['notifications', 'clipboard-read'])
  callback(allowed.has(permission))
})

// Synchronous check for permissions queried without a prompt
session.defaultSession.setPermissionCheckHandler((_wc, permission) => {
  return permission === 'notifications'
})

const untrusted = new BrowserWindow({
  webPreferences: {
    partition: 'persist:untrusted', // separate cookie/storage jar
    sandbox: true,
    contextIsolation: true,
    nodeIntegration: false,
    // no preload — this window has zero bridge to your privileged code
  },
})

import { safeStorage } from 'electron'

if (safeStorage.isEncryptionAvailable()) {
  const blob = safeStorage.encryptString(token)      // store this blob on disk
  const token = safeStorage.decryptString(blob)      // decrypt at runtime
}

import { flipFuses, FuseV1Options, FuseVersion } from '@electron/fuses'

await flipFuses(electronBinaryPath, {
  version: FuseVersion.V1,
  [FuseV1Options.RunAsNode]: false,
  [FuseV1Options.EnableNodeCliInspectArguments]: false,
  [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
  [FuseV1Options.OnlyLoadAppFromAsar]: true,
  [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
})