I audited the Electron apps on my Mac: Claude 6/6, Cursor 0/6, Postman 1/6

A developer audited the Electron fuses of three popular Mac desktop apps and found Claude 3.1623.0 enabled all six recommended hardening switches, Postman 12.33.2 enabled one, and Cursor 3.26.13 enabled none. The check, run via the open-source REA MCP server's inspect_electron_fuses tool, found Cursor left RunAsNode, NODE_OPTIONS injection, and --inspect flags enabled while disabling cookie encryption and ASAR integrity validation. The developer noted the gaps require an attacker to already have code running as the user, but matter for tools holding source code, API keys and tokens.

Updated October 21, 2026: re-tested on the latest releases, Cursor 3.26.13 and Postman 12.33.2 first tested on Cursor 3.1.15 and Postman 11.93.0 . The results did not change. Three popular desktop apps run on the same framework, Electron, but lock it down very differently. On my Mac, Claude 3.1623.0 turned on all six hardening switches I checked, Postman 12.33.2 turned on one, and Cursor 3.26.13 turned on none. Those switches decide whether another program on your machine can quietly run code with the app's identity, permissions and signed-in sessions. Checking them took one read-only command per app and no special access. Fuses are on/off switches written into an Electron app's framework binary when the app is packaged. Unlike settings in the app's code, they can't be changed at runtime, so they are a cheap, reliable way to remove risky features before shipping. The six I checked, and the safe setting for each: | Fuse | Safe setting | Why it matters | |---|---|---| | RunAsNode | Off | When on, setting ELECTRON RUN AS NODE makes the app's binary act as a plain Node.js runtime | | EnableNodeOptionsEnvironmentVariable | Off | When on, the NODE OPTIONS variable can inject code or flags at startup | | EnableNodeCliInspectArguments | Off | When on, --inspect flags can attach a debugger to the app's main process | | EnableCookieEncryption | On | Encrypts the app's stored cookies with a key from the OS keychain | | EnableEmbeddedAsarIntegrityValidation | On | Checks the app's packaged code against a hash before loading it | | OnlyLoadAppFromAsar | On | Refuses to load app code from anywhere except the verified archive | Electron's own security guidance recommends this hardened configuration; it is not the framework's default, so each vendor has to opt in. I used REA Reverse Engineer Anything https://github.com/morluto/rea , an open-source MCP server, driven from Claude Code. Its inspect electron fuses tool finds the fuse block inside each app's Electron Framework binary and reports every fuse's raw byte. Versions tested on macOS 15.1 on October 21, 2026: Claude 3.1623.0, Cursor 3.26.13, Postman 12.33.2 arm64 build . Claude passed every check, Postman passed one, and Cursor passed none. | Fuse safe setting | Claude 3.1623.0 | Cursor 3.26.13 | Postman 12.33.2 | |---|---|---|---| | RunAsNode off | Off ✓ | On ✗ | On ✗ | | NODE OPTIONS allowed off | Off ✓ | On ✗ | On ✗ | | --inspect flags allowed off | Off ✓ | On ✗ | Off ✓ | | Cookie encryption on | On ✓ | Off ✗ | Off ✗ | | ASAR integrity check on | On ✓ | Off ✗ | Off ✗ | | Only load from ASAR on | On ✓ | Off ✗ | Off ✗ | | Score | 6/6 | 0/6 | 1/6 | --inspect . All three leave GrantFileProtocolExtraPrivileges on; I left it out of the score because disabling it can break apps that load local files. These gaps don't let anyone break into your Mac; an attacker already needs code running as your user. What they change is what that code can do next. The Cursor result has context. It's built on VS Code, whose extension host has historically depended on running Electron as Node, so turning RunAsNode off isn't a one-line change. That explains it; it doesn't make the other five settings necessary. Vendors usually rate this class as low severity, and I agree it's hardening rather than an emergency. It still matters for an AI code editor and an API client: both hold source code, API keys and tokens. You can run the same check in a minute, with or without an AI agent. Contents/Frameworks/Electron Framework.framework inside its bundle is Electron. npx @electron/fuses read --app /Applications/<App .app , or ask an agent with REA installed to run inspect electron fuses on the app. If you ship an Electron app, flip the fuses at package time with @electron/fuses Electron Forge and electron-builder both support it . Turn on ASAR integrity and OnlyLoadAppFromAsar together, and test your auto-updater and any native modules after each change. This is the first in a series of teardowns of everyday desktop apps. Next, I'll follow how one of these apps moves data between its web page and the operating system, through the preload script and IPC. If you build an Electron app and want the same check run on it, with a short report, get in touch. Subscribe to get the next teardown.