Electron Cursor Rules Template

---
description: "Process Architecture"
alwaysApply: false
---
- Use IPC (ipcMain/ipcRenderer) for main-renderer communication — never access Node APIs from renderer directly.
- Keep the main process minimal: app lifecycle, window management, native menus, and IPC handlers only.
- Use contextBridge.exposeInMainWorld() to safely expose APIs to the renderer process.
- Set contextIsolation: true and nodeIntegration: false in webPreferences for security.
- Use preload scripts to bridge main and renderer processes — never enable nodeIntegration.
- Use BrowserWindow with sandbox: true for untrusted content.

---
description: "Security Best Practices"
alwaysApply: false
---
- Validate all external URLs before loading them in BrowserWindow or webview.
- Use Content-Security-Policy headers to prevent XSS and code injection.
- Disable remote module: set enableRemoteModule: false.
- Never trust user input in IPC handlers — validate and sanitize all arguments.
- Use webContents.session.setPermissionRequestHandler() to manage permissions.
- Keep Electron and all dependencies updated to the latest stable versions.
- Use electron-builder or electron-forge for packaging with code signing.

---
description: "Performance & Optimization"
alwaysApply: false
---
- Lazy-load heavy modules only when needed — avoid loading them at startup.
- Use BrowserWindow pooling for multi-window apps instead of creating/destroying windows repeatedly.
- Offload CPU-intensive work to a hidden BrowserWindow or Worker thread.
- Use webFrame.setZoomLevel() sparingly — prefer CSS zoom for UI scaling.
- Monitor memory usage and implement cleanup for long-running windows.
- Use requestIdleCallback for non-critical renderer work.
- Minimize main process synchronous operations — use async IPC handlers.