Agent WranglersDSK-31Recommended
Turn off the Electron fuses the app does not use
Before signing an Electron app, flip its fuses so the binary ignores ELECTRON_RUN_AS_NODE, NODE_OPTIONS and --inspect flags, and checks the integrity of app.asar. Read the fuse state of every release build in CI.
How to do it
Fuses are switches inside the Electron binary, flipped before code signing. With the defaults, any local program can start your signed app as a plain Node.js runtime and run its own code inside it. Electron says most apps can safely disable the NODE_OPTIONS and inspect fuses, and safely enable asar integrity checks and cookie encryption. Use utility processes instead of RunAsNode. Turn on OnlyLoadAppFromAsar together with integrity validation. Turn off GrantFileProtocolExtraPrivileges when no page loads from file://. Cookie encryption cannot be turned off again without corrupting the cookie store. Electron Forge flips fuses with its fuses plugin, and npx @electron/fuses read --app <path> prints them. Fuses add to Keep web content away from the operating system. The CI read sits next to Check every signature in CI before you publish.
How to check
A CI step reads the fuses of each packaged build. RunAsNode, EnableNodeOptionsEnvironmentVariable and EnableNodeCliInspectArguments are off, and EnableEmbeddedAsarIntegrityValidation and OnlyLoadAppFromAsar are on. Starting the app with ELECTRON_RUN_AS_NODE=1 opens the app, not a Node.js prompt.
Sources
Related rules
- DSK-10 Keep web content away from the operating system in Desktop apps and extensions
- DSK-4 Check every signature in CI before you publish in Desktop apps and extensions
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/electron-fuses">Agent Wranglers desktop apps and extensions playbook</a>. In code you write, add a comment next to it with the same link.