---
title: "Turn off the Electron fuses the app does · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/electron-fuses
id: DSK-31
level: Recommended
updated: 2026-10-22
build: a2a6bdfed830
tokens: 876
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Turn off the Electron fuses the app does not use

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Web code inside desktop apps](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: DSK-31
- Level: Recommended
- Chapter: [Web code inside desktop apps](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps.md)
- Rule: Before signing an Electron app, flip its fuses so the binary ignores `ELECTRON_RUN_AS_NODE`, `NODE_OPTIONS` and `--inspect` flags, and checks the integrity of `app.asar`. Read the fuse state of every release build in CI.
- Check: A CI step reads the fuses of each packaged build. `RunAsNode`, `EnableNodeOptionsEnvironmentVariable` and `EnableNodeCliInspectArguments` are off, and `EnableEmbeddedAsarIntegrityValidation` and `OnlyLoadAppFromAsar` are on. Starting the app with `ELECTRON_RUN_AS_NODE=1` opens the app, not a Node.js prompt.
- How: Fuses are switches inside the Electron binary, flipped before code signing. With the defaults, any local program can start your signed app as a plain Node.js runtime and run its own code inside it. Electron says most apps can safely disable the `NODE_OPTIONS` and inspect fuses, and safely enable asar integrity checks and cookie encryption. Use utility processes instead of `RunAsNode`. Turn on `OnlyLoadAppFromAsar` together with integrity validation. Turn off `GrantFileProtocolExtraPrivileges` when no page loads from `file://`. Cookie encryption cannot be turned off again without corrupting the cookie store. Electron Forge flips fuses with its fuses plugin, and `npx @electron/fuses read --app <path>` prints them. Fuses add to [Keep web content away from the operating system](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/isolate-web-content.md). The CI read sits next to [Check every signature in CI before you publish](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish.md).

## Sources

- [Electron, Fuses](https://www.electronjs.org/docs/latest/tutorial/fuses)

## Related rules

- DSK-10 [Keep web content away from the operating system](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/isolate-web-content.md) in Desktop apps and extensions
- DSK-4 [Check every signature in CI before you publish](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish.md) in Desktop apps and extensions

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/electron-fuses">Agent Wranglers desktop apps and extensions playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Treat every link to the app's own scheme as untrusted input](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/app-scheme-links.md)
- Next: [Give each Tauri window only the permissions it uses](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/tauri-capabilities.md)
- [Web code inside desktop apps](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps.md)