Keep secure window defaults

Every window is a separate security decision. Return to each BrowserWindow and verify these settings:

webPreferences: {
  preload: MAIN_WINDOW_PRELOAD_WEBPACK_ENTRY,
  contextIsolation: true,
  nodeIntegration: false,
  sandbox: true
}

Modern Electron releases default to context isolation and renderer sandboxing. Do not disable either feature to make an import work.

If renderer code needs an npm package, bundle a browser-compatible package through Webpack. If it needs files or native Electron APIs, add one validated preload capability.

Never load remote content into a window that has Node integration. Remote content can change outside your release process.

Also confirm that you did not weaken adjacent controls:

• webSecurity remains enabled
• insecure mixed content is not allowed
• experimental Blink features are not enabled casually
• the page has a restrictive Content Security Policy
• navigation, new windows, and permissions are explicitly controlled

Defaults can change and generated configuration can hide an override. Keeping the important values explicit makes code review easier.

Run a boundary test in renderer DevTools. require('node:fs') should not work, while window.notesAPI.loadNotes should exist. Then inspect the preload API and verify it exposes no raw Electron object.

Security options reduce damage; they do not make renderer input trusted. IPC sender checks and value validation remain necessary.