Setting sandbox to false so that bytecode plugin works is a security threat

kotasudhakar commented 7 months ago

I understand that it was asked to turn the sandbox option to false in order to protect source code using bytecode plugin as it uses the nodevm, however it is kinda dangerous tbh to do so although there are still other options like contextIsolation to prevent render process accessing the main process.

Can we do in any other alternative way so that we no need to set the sandbox value to false for browserWindow options and improving security? may be using something like Jailed/Hermes

https://electron-vite.org/guide/source-code-protection

kotasudhakar commented 6 months ago

@caoxiemeihao @youngleish @sevenc-nanashi @skyrpex @lifeiscontent @magicdawn @jsonnull @yooouuri

yejimeiming commented 1 month ago

It is recommended that you use electron-vite instead of vite-plugin-electron

electron-vite / vite-plugin-electron

Setting sandbox to false so that bytecode plugin works is a security threat #231