Default configuration creates a project that exposes the entire electron API to the renderer by default.

[stickynotememo]

Describe the bug

To reproduce:

npm create @quick-start/electron@latest
# accept defaults

src/preload/index.js contains this line:

    contextBridge.exposeInMainWorld('electron', electronAPI)

According to the electron tutorial, exposing just the ipcRenderer module is highly dangerous, let alone the entire Electron API. This should be changed to a more secure default.

I can open a PR but I'm not sure if there are other places in the project with the same vulnerability.

Used Scaffolding

create-electron

Used Package Manager

npm

Validations

• Follow the Code of Conduct.
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.