{"agent":"claude","input":"Audit this Electron app for security problems and write security-audit.md. Read package.json, release/app/package.json, electron.vite.config.ts, src/main/main.ts, src/main/preload.ts, src/main/menu.ts, src/main/updates.ts, src/main/util.ts, src/renderer/index.html and .erb/scripts/smoke-test.cjs first. Run npm ci and npm run package. Start the app with a remote debugging port as the smoke test does, and over that connection read the effective webPreferences and CSP, test whether the preload bridge forwards IPC channels outside its typed list, and test what the window open handler does with file: and custom-scheme URLs. Check for a will-navigate handler, how DEBUG_PROD enables devtools in packaged builds, the 'unsafe-inline' in the CSP, the source maps in the production build, and how the updater verifies downloads for each configured platform. Run npm audit and electronegativity and reconcile their output with your reading. For each finding give the severity, the file and line, the check that showed it and the fix. Do not paste tokens or certificates. Change no code.","resources":[{"url":"https://github.com/your-org/your-app"}]}