electron-app-stinger

Pair a named ipcMain.handle channel with a single preload method that calls ipcRenderer.invoke for that channel only. Never expose the whole ipcRenderer object or forward event objects, and re-validate all payloads in the main process.

Use a preload script with contextBridge.exposeInMainWorld to expose one narrow method per allowed native action. Keep Node integration disabled for any renderer loading remote content and preserve context isolation.

Electron suits apps needing the mature Node and Chromium ecosystem with established packaging and update tooling. Tauri is an alternative desktop boundary covered by a separate skill when a Rust-based, smaller-footprint shell is preferred.

Node integration in a renderer loading remote content lets an XSS vulnerability escalate into arbitrary code execution on the user's machine. Electron's official security guidance says to disable it and use preload with contextBridge instead.

Do not use it for reverse engineering third-party Electron apps, which belongs to separate dissection material, or for Tauri-specific desktop work. Generic TypeScript or frontend design questions should go to the relevant language or UI skill.