Two Electron loadouts that work together. The first writes the security checklist into rules: contextIsolation and sandbox on, a narrow contextBridge API, IPC handlers that check the sender frame and validate every argument, deny-by-default windows, CSP and fuses, with a static check. The second proves it in a running app: Playwright launches Electron with a fresh userData folder per test, asserts the web preferences from the main process, and drives each IPC feature through the UI.
Every one installs for Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity CLI and GitHub Copilot unless its card says otherwise.
Electron rules for agents: sandboxed renderers, narrow contextBridge APIs, sender-checked IPC, deny-by-default windows, CSP and fuses, with a static security check.
Playwright tests that drive the real Electron app: secure webPreferences, no Node in the renderer, IPC round trips, input validation and blocked navigation.
Looking for something narrower? Search within Electron or filter everything.