high
Electron 35.2.0 no longer receives security fixes
8 major versions behind the oldest supported line (as of 2026-10-22, Electron 43–45 are supported). Its bundled Chromium misses every fix since.
Gallery · App X-Ray
Standard Notes 3.110.214
- 1 high
- 0 medium
- 1 low
- 2 info
Findings
low
IPC handlers do not check the sender
3 main-process handlers, and no check of event.senderFrame or event.sender was found. Any page that can send IPC, including an injected one, is trusted.
info
IPC channel names chosen at runtime
13 IPC calls take the channel name from a variable. When a preload script forwards a channel chosen by the page, the page can reach every handler; worth reviewing.
info
Stores data on this device
Uses local-storage (5 uses).
app/javascripts/Renderer/DesktopDevice.ts:123 · app/javascripts/Renderer/Renderer.ts:76 · app/javascripts/Renderer/DesktopDevice.ts:104 · app/javascripts/Renderer/Renderer.ts:71 · app/javascripts/Renderer/DesktopDevice.ts:115
Network addresses
No literal network addresses found.
Modules
| Module | Used by |
|---|---|
| ../../../../test/TestIpcMessage | app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Store/Store.ts, app/javascripts/Main/Utils/Testing.ts |
| ../../../test/TestIpcMessage | app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Window.ts |
| ../../AppState | app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Window.ts |
| ../../Renderer/CrossProcessBridge | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../../Shared/CommandLineArgs | app/javascripts/Main/Utils/Utils.ts |
| ../../Shared/IpcMessages | app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/HomeServer/HomeServerManager.ts, app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Packages/PackageManager.ts |
| ../File/FileErrorCodes | app/javascripts/Main/Packages/PackageManager.ts, app/javascripts/Main/Store/createSanitizedStoreData.ts |
| ../File/FilesManager | app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Packages/PackageManager.ts |
| ../File/FilesManagerInterface | app/javascripts/Main/Directory/DirectoryManager.ts, app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/HomeServer/HomeServerManager.ts, app/javascripts/Main/Packages/PackageManager.ts |
| ../Keychain/KeychainInterface | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Localization/MainProcessLocalization | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Main/Packages/PackageManagerInterface | app/javascripts/Renderer/CrossProcessBridge.ts, app/javascripts/Renderer/DesktopDevice.ts |
| ../Media/MediaManagerInterface | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Menus/MenuManagerInterface | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Packages/PackageManagerInterface | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Search/SearchManagerInterface | app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Shared/ElectronMainEvents | app/javascripts/Renderer/Preload.ts, app/javascripts/Renderer/Renderer.ts |
| ../Shared/IpcMessages | app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Window.ts, app/javascripts/Renderer/Preload.ts, app/javascripts/Renderer/grantLinuxPasswordsAccess.js |
| ../SpellcheckerManager | app/javascripts/Main/Store/StoreKeys.ts, app/javascripts/Main/Store/createSanitizedStoreData.ts |
| ../Store/Store | app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Keychain/KeychainInterface.ts, app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Store/StoreKeys | app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/Remote/RemoteBridge.ts |
| ../Strings | app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Localization/MainProcessLocalization.ts, app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/Packages/PackageManager.ts |
| ../TrayManager | app/javascripts/Main/Menus/Menus.ts |
| ../Types/Constants | app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Menus/Menus.ts |
| ../Types/Paths | app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Packages/PackageManager.ts |
| ../Types/Platforms | app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Menus/Menus.ts |
| ../UpdateManager | app/javascripts/Main/Menus/Menus.ts |
| ../Utils/Testing | app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Store/Store.ts |
| ../Utils/Utils | app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Packages/PackageManager.ts, app/javascripts/Main/Store/Store.ts, app/javascripts/Main/Store/createSanitizedStoreData.ts, app/javascripts/Main/Strings/index.ts, app/javascripts/Main/Utils/Testing.ts |
| ./../../../Logging | app/javascripts/Main/FileBackups/FileBackupsManager.ts |
| ./../SpellcheckerManager | app/javascripts/Main/Menus/Menus.ts |
| ./@types/modules | app/index.ts |
| ./application | app/index.ts |
| ./AppState | app/application.ts |
| ./createSanitizedStoreData | app/javascripts/Main/Store/Store.ts |
| ./CrossProcessBridge | app/javascripts/Renderer/DesktopDevice.ts, app/javascripts/Renderer/Renderer.ts |
| ./DataInterface | app/javascripts/Main/Remote/RemoteBridge.ts |
| ./DesktopDevice | app/javascripts/Renderer/Renderer.ts |
| ./Directory/DirectoryManager | app/javascripts/Main/Window.ts |
| ./enableExperimentalWebFeatures | app/index.ts |
| ./File/FileErrorCodes | app/javascripts/Main/ExtensionsServer.ts |
| ./File/FilesManager | app/javascripts/Main/Window.ts |
| ./FileBackups/FileBackupsManager | app/javascripts/Main/Window.ts |
| ./FileDownloader | app/javascripts/Main/FileBackups/FileBackupsManager.ts |
| ./FileErrorCodes | app/javascripts/Main/File/FilesManager.ts |
| ./FileNetworking | app/javascripts/Main/FileBackups/FileDownloader.ts |
| ./FileReadOperation | app/javascripts/Main/FileBackups/FileBackupsManager.ts |
| ./FilesManagerInterface | app/javascripts/Main/File/FilesManager.ts |
| ./HomeServer/HomeServerManager | app/javascripts/Main/Window.ts |
| ./HomeServerConfigurationFile | app/javascripts/Main/HomeServer/HomeServerManager.ts |
| ./javascripts/Main/ExtensionsServer | app/application.ts |
| ./javascripts/Main/Keychain/Keychain | app/application.ts |
| ./javascripts/Main/Store/Store | app/AppState.ts, app/index.ts |
| ./javascripts/Main/Store/StoreKeys | app/AppState.ts, app/application.ts, app/index.ts |
| ./javascripts/Main/Strings | app/application.ts |
| ./javascripts/Main/Types/Constants | app/index.ts |
| ./javascripts/Main/Types/Paths | app/AppState.ts, app/index.ts |
| ./javascripts/Main/Types/Platforms | app/application.ts |
| ./javascripts/Main/UpdateManager | app/AppState.ts |
| ./javascripts/Main/Utils/Utils | app/Logging.ts, app/application.ts |
| ./javascripts/Main/Window | app/AppState.ts, app/application.ts |
| ./javascripts/Shared/CommandLineArgs | app/index.ts |
| ./Keychain/Keychain | app/javascripts/Main/Window.ts |
| ./KeychainInterface | app/javascripts/Main/Keychain/Keychain.ts |
| ./Localization/MainProcessLocalization | app/javascripts/Main/Window.ts |
| ./Media/MediaManager | app/javascripts/Main/Window.ts |
| ./MediaManagerInterface | app/javascripts/Main/Media/MediaManager.ts |
| ./MenuManagerInterface | app/javascripts/Main/Menus/Menus.ts |
| ./Menus/MenuManagerInterface | app/javascripts/Main/Window.ts |
| ./Menus/Menus | app/javascripts/Main/Window.ts |
| ./Networking | app/javascripts/Main/Packages/PackageManager.ts |
| ./PackageManagerInterface | app/javascripts/Main/Packages/PackageManager.ts |
| ./Packages/PackageManager | app/javascripts/Main/Window.ts |
| ./Remote/RemoteBridge | app/javascripts/Main/Window.ts |
| ./Search/SearchManager | app/javascripts/Main/Window.ts |
| ./SearchManagerInterface | app/javascripts/Main/Search/SearchManager.ts |
| ./SpellcheckerManager | app/javascripts/Main/Window.ts |
| ./Store | app/javascripts/Main/Store/createSanitizedStoreData.ts |
| ./Store/Store | app/javascripts/Main/SpellcheckerManager.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/Window.ts, app/javascripts/Main/ZoomManager.ts |
| ./Store/StoreKeys | app/javascripts/Main/SpellcheckerManager.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Window.ts, app/javascripts/Main/ZoomManager.ts |
| ./StoreKeys | app/javascripts/Main/Store/Store.ts, app/javascripts/Main/Store/createSanitizedStoreData.ts |
| ./strings | app/javascripts/Main/Strings/index.ts |
| ./Strings | app/javascripts/Main/ExtensionsServer.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/UpdateManager.ts |
| ./TrayManager | app/javascripts/Main/Window.ts |
| ./types | app/javascripts/Main/Strings/index.ts, app/javascripts/Main/Strings/strings.ts |
| ./Types/Constants | app/javascripts/Main/UpdateManager.ts |
| ./Types/Paths | app/javascripts/Main/ExtensionsServer.ts, app/javascripts/Main/Window.ts |
| ./Types/Platforms | app/javascripts/Main/SpellcheckerManager.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/Window.ts |
| ./UpdateManager | app/javascripts/Main/Window.ts |
| ./Utils/Testing | app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Window.ts |
| ./Utils/Utils | app/javascripts/Main/SpellcheckerManager.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Window.ts |
| ./ZoomManager | app/javascripts/Main/Window.ts |
| @electron/remote | app/javascripts/Main/Store/Store.ts, app/javascripts/Renderer/Preload.ts |
| @electron/remote/main | app/index.ts, app/javascripts/Main/Window.ts |
| @standardnotes/domain-core | app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/File/FilesManagerInterface.ts |
| @standardnotes/electron-clear-data | app/javascripts/Main/Window.ts |
| @standardnotes/features | app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/Strings/strings.ts |
| @standardnotes/home-server | app/javascripts/Main/HomeServer/HomeServerManager.ts |
| @standardnotes/snjs | app/javascripts/Main/Directory/DirectoryManager.ts, app/javascripts/Main/HomeServer/HomeServerConfigurationFile.ts, app/javascripts/Main/Localization/MainProcessLocalization.ts, app/javascripts/Main/Remote/RemoteBridge.ts, app/javascripts/Renderer/CrossProcessBridge.ts |
| @standardnotes/utils | app/Logging.ts, app/javascripts/Main/FileBackups/FileBackupsManager.ts |
| @web/Application/Device/DesktopSnjsExports | app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/FileBackups/FileReadOperation.ts, app/javascripts/Main/HomeServer/HomeServerManager.ts, app/javascripts/Main/Remote/RemoteBridge.ts, app/javascripts/Renderer/CrossProcessBridge.ts, app/javascripts/Renderer/DesktopDevice.ts, app/javascripts/Renderer/Renderer.ts |
| @web/Application/Device/StartApplication | app/javascripts/Renderer/Renderer.ts |
| @web/Application/Device/WebOrDesktopDevice | app/javascripts/Renderer/DesktopDevice.ts |
| app/AppState | app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/Menus/Menus.ts |
| axios | app/javascripts/Main/FileBackups/FileNetworking.ts |
| compare-versions | app/javascripts/Main/Packages/PackageManager.ts, app/javascripts/Main/UpdateManager.ts |
| copy-webpack-plugin | desktop.webpack.common.js |
| crypto | app/javascripts/Main/HomeServer/HomeServerManager.ts |
| decrypt/dist/decrypt.html | app/javascripts/Main/Types/Paths.ts |
| dotenv | desktop.webpack.common.js |
| electron | app/application.ts, app/enableExperimentalWebFeatures.ts, app/index.ts, app/javascripts/Main/Directory/DirectoryManager.ts, app/javascripts/Main/ExtensionsServer.ts, app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/HomeServer/HomeServerManager.ts, app/javascripts/Main/Keychain/Keychain.ts, app/javascripts/Main/Keychain/KeychainInterface.ts, app/javascripts/Main/Media/MediaManager.ts, app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Remote/RemoteBridge.ts, app/javascripts/Main/Search/SearchManager.ts, app/javascripts/Main/Store/Store.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/Types/Paths.ts, app/javascripts/Main/UpdateManager.ts, app/javascripts/Main/Utils/Testing.ts, app/javascripts/Main/Window.ts, app/javascripts/Main/ZoomManager.ts, app/javascripts/Renderer/Preload.ts, app/javascripts/Renderer/grantLinuxPasswordsAccess.js |
| electron-log | app/index.ts, app/javascripts/Main/Packages/PackageManager.ts, app/javascripts/Main/UpdateManager.ts |
| electron-updater | app/javascripts/Main/UpdateManager.ts |
| electron/renderer | app/javascripts/Renderer/Renderer.ts, app/javascripts/Shared/ElectronMainEvents.ts |
| fs | app/javascripts/Main/ExtensionsServer.ts, app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/File/FilesManagerInterface.ts, app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/FileBackups/FileDownloader.ts, app/javascripts/Main/FileBackups/FileNetworking.ts, app/javascripts/Main/FileBackups/FileReadOperation.ts, app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Packages/PackageManager.ts, app/javascripts/Main/Store/Store.ts, app/javascripts/Main/Store/createSanitizedStoreData.ts, app/javascripts/Main/Window.ts |
| fs-extra | app/index.ts, app/javascripts/Main/File/FilesManager.ts |
| fs/promises | app/javascripts/Main/Localization/MainProcessLocalization.ts |
| http | app/javascripts/Main/ExtensionsServer.ts |
| keytar | app/javascripts/Main/Keychain/Keychain.ts |
| lodash | app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/Window.ts |
| mime-types | app/javascripts/Main/ExtensionsServer.ts |
| mobx | app/javascripts/Main/Menus/Menus.ts, app/javascripts/Main/UpdateManager.ts |
| os | app/javascripts/Main/HomeServer/HomeServerManager.ts |
| path | app/index.ts, app/javascripts/Main/Directory/DirectoryManager.ts, app/javascripts/Main/ExtensionsServer.ts, app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/FileBackups/FileBackupsManager.ts, app/javascripts/Main/HomeServer/HomeServerManager.ts, app/javascripts/Main/Localization/MainProcessLocalization.ts, app/javascripts/Main/Packages/Networking.ts, app/javascripts/Main/Packages/PackageManager.ts, app/javascripts/Main/Remote/RemoteBridge.ts, app/javascripts/Main/Store/Store.ts, app/javascripts/Main/TrayManager.ts, app/javascripts/Main/Types/Paths.ts, app/javascripts/Main/Window.ts, desktop.webpack.common.js |
| stream | app/javascripts/Main/Packages/Networking.ts |
| terser-webpack-plugin | desktop.webpack.common.js |
| ttag | app/javascripts/Main/File/FilesManager.ts, app/javascripts/Main/HomeServer/HomeServerManager.ts, app/javascripts/Main/Localization/MainProcessLocalization.ts, app/javascripts/Main/Strings/strings.ts |
| url | app/javascripts/Main/ExtensionsServer.ts |
| util | app/javascripts/Main/Packages/Networking.ts |
| webpack | desktop.webpack.common.js |
| webpack-merge | desktop.webpack.dev.js, desktop.webpack.prod.js |
| yauzl | app/javascripts/Main/File/FilesManager.ts |
Windows and IPC
| Window | webPreferences |
|---|---|
| app/javascripts/Main/Keychain/Keychain.ts:43 | contextIsolation=true, nodeIntegration=false, preload=? |
| app/javascripts/Main/Window.ts:161 | contextIsolation=true, nodeIntegration=?, preload=?, sandbox=true, spellcheck=true |
No IPC channels found.
Remote pages, data and packaging
No remote pages are loaded into app windows.
| Storage | How | Where |
|---|---|---|
| local-storage | call:window.localStorage.removeItem | app/javascripts/Renderer/DesktopDevice.ts:123 |
| local-storage | call:window.localStorage.removeItem | app/javascripts/Renderer/Renderer.ts:76 |
| local-storage | call:window.localStorage.getItem | app/javascripts/Renderer/DesktopDevice.ts:104 |
| local-storage | call:window.localStorage.getItem | app/javascripts/Renderer/Renderer.ts:71 |
| local-storage | call:window.localStorage.setItem | app/javascripts/Renderer/DesktopDevice.ts:115 |
No packaged executable was found, so Electron fuses were not read.
README badge
Maintainers can show this report in their README:
[](https://Eliot5566.github.io/app-xray/apps/standard-notes/)
What this report cannot see
- Source checkout: 21 test, story, build-tool and minified/generated files were left out. Rerun with --all-files to include them.
- CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.
- Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.
- Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.
- Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.
- Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.
- JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.
- Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.
- Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.
- Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.