Electron definitely offers a developer some real foot cannons - of this there is no doubt. But to be fair, it also offers some great security capabilities, ala

Electron definitely offers a developer some real foot cannons - of this there is no doubt. But to be fair, it also offers some great security capabilities, ala Chrome, like Content Security Policies and a seriously solid sandbox that has had untold (wo)man-centuries of work put into keeping it isolated from priveleged contexts. Yes, you need to be very careful about stepping over the holy line, but this really isn’t that different from the kind of common sense barrier we’ve all learned to maintain between a web server and a browser client. If someone accidentally throws an API key into some browser js, you’re in trouble. This kind of mistake gets made sometimes (even at high levels) but for the most part, any serious developer will know how to enforce a hard line between the server and the client—it’s table stakes. A simple approach for Electron is to keep the bulk of your application in a browser window with nodeIntegration: false and then set a strict CSP on the root html doc. In this way, most of your code and most of your dependencies will be isolated from the os and the network, and you can carefully whitelist the exceptions. That’s actually pretty damn hard to do yourself in a purely native app. In short, if you take some time to learn best practices, you can make a pretty damn secure app with Electron. If you can’t be bothered, then yeah, your users will be in real danger, but they’d be in just as much (or more) danger if you made similar mistakes in native code. I have tried to do a good job building a secure Electron app with EnvKey[1], a tool for managing configuration and secrets with end-to-end encryption. All the client-side code is open source[2] and has its security choices documented[3]. Feel free to take a peek if you’re interested in seeing a live example! Oh, and since one’s perfect, please post an issue or a PR if you spot any problems. I will owe you a beer :) 1 - https://www.envkey.com https://www.envkey.com 2 - https://github.com/envkey/envkey-app https://github.com/envkey/envkey-app 3 - https://security.envkey.com https://security.envkey.com