Electron apps, like Capacitor app, are trusted content. This is a red herring. However, both can have a bug that exposes XSS and give direct access to all the

Electron apps, like Capacitor app, are trusted content. This is a red herring. However, both can have a bug that exposes XSS and give direct access to all the nice APIs both add. For example, adding a SQLite plugin gives the attacker full access to all local db data for the app. Or node APIs vs FileSystem APIs. The solution to have have two threads and let the dev specify their own API to communicate. Electron had bad solutions for a while but it’s gotten better these days and might offer some ideas I’m a fan of your work improving the stalled Apache product and moving it forward as Capacitor. I use it! v2 though, as I haven’t upgraded to v3. Maybe I’ll try that this weekend.