This MVP is a local desktop app that loads only its own packaged renderer and local assets.

Current runtime:

• contextIsolation: true
• nodeIntegration: false
• typed preload bridge only
• renderer cannot directly access Node APIs
• CSP is applied in index.html and reinforced from the Electron session layer
• no eval
• no arbitrary remote BrowserWindow navigation

Current compatibility exception:

• sandbox is temporarily disabled for the packaged renderer runtime

Reason:

• the packaged Electron build hit a real preload bridge failure where window.softwareCoach was not injected
• the current MVP prioritizes a working typed preload bridge over a broken sandboxed packaged app

Boundary:

• this is not the final target security posture
• the intended target remains sandbox: true
• until that is restored, the app continues to rely on contextIsolation, nodeIntegration: false, narrow IPC, and a local-only renderer asset policy

Unused permissions are denied by default.

This MVP does not request:

• microphone
• camera
• arbitrary remote navigation
• renderer-side filesystem access

Screen capture is initiated through Electron main process IPC, not from direct renderer privileges.

Privileged operations are limited to:

• run coach session
• save feedback
• get settings
• update settings
• capture screen
• select local image
• export session json

• API keys must come from environment variables
• API keys are not written to the config file
• screenshots are not persisted by default

This project does not attempt to secure:

• a compromised local machine
• a malicious local administrator
• a malicious model server selected by the user

It does attempt to reduce accidental privilege exposure inside the renderer and keep default operation local and explicit.

• restore sandbox: true in packaged builds without breaking preload
• add explicit runtime logging for preload bridge failures in release builds
• review whether the current CSP can be tightened again after the preload path is stabilized