Harden app for release readiness

electron/main.ts

@@ -6,6 +6,8 @@ import { fileURLToPath } from "node:url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+app.setAppUserModelId("de.wilkensxl.envhelper");
+
 async function createWindow() {
   const win = new BrowserWindow({
     width: 1220,
@@ -19,11 +21,24 @@ async function createWindow() {
     webPreferences: {
       preload: path.join(__dirname, "preload.js"),
       contextIsolation: true,
-      nodeIntegration: false
+      nodeIntegration: false,
+      sandbox: true,
+      webSecurity: true,
+      allowRunningInsecureContent: false,
+      devTools: !app.isPackaged
     }
   });
 
   Menu.setApplicationMenu(null);
+  win.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+  win.webContents.on("will-navigate", (event, url) => {
+    const currentUrl = win.webContents.getURL();
+    if (!currentUrl || url === currentUrl || (!app.isPackaged && url.startsWith("http://127.0.0.1:5173"))) {
+      return;
+    }
+
+    event.preventDefault();
+  });
 
   if (!app.isPackaged) {
     await win.loadURL("http://127.0.0.1:5173");
@@ -56,6 +71,10 @@ ipcMain.handle("envhelper:open-file", async (event) => {
 });
 
 ipcMain.handle("envhelper:save-file", async (event, content: string) => {
+  if (typeof content !== "string") {
+    throw new TypeError("Save content must be a string.");
+  }
+
   const owner = BrowserWindow.fromWebContents(event.sender);
   const options = {
     defaultPath: ".env",