Gallery · App X-Ray

Stretchly 1.22.1

Electron 44.9.3 · 92 addresses · 29 modules · 39 IPC channels

0 high
1 medium
1 low
2 info

Findings

medium

sandbox: false

8 windows set sandbox to false, so the renderer runs without Chromium's OS sandbox.

app/main.js:658 · app/main.js:737 · app/main.js:909 · app/main.js:1390 · app/main.js:707 · app/main.js:676 · app/main.js:1079 · app/main.js:1805

low

IPC handlers do not check the sender

31 main-process handlers, and no check of event.senderFrame or event.sender was found. Any page that can send IPC, including an injected one, is trusted.

info

Electron 44.9.3 is supported

as of 2026-10-22, Electron 43–45 are supported.

info

IPC channel names chosen at runtime

4 IPC calls take the channel name from a variable. When a preload script forwards a channel chosen by the page, the page can reach every handler; worth reviewing.

Network addresses

Host	Address	How	Where
—	__internal__	call:settings.get	app/main.js:1736
—	_migratedOpenAtLogin	call:settings.get	app/main.js:434
—	33881JanHovancik.stretchly_24fg4m0zq65je!Stretchly	property:path	app/utils/autostartManager.js:23
—	allScreens	call:settings.get	app/main.js:970
—	appExclusions	call:settings.get	app/utils/appExclusionsManager.js:20
—	appExclusionsCheckInterval	call:settings.get	app/utils/appExclusionsManager.js:10
—	appExclusionsCheckInterval	call:store.get	app/main.js:376
—	audio	call:store.get	app/main.js:324
—	blurredBackground	call:settings.get	app/main.js:799
—	break	call:settings.get	app/utils/statusMessages.js:58
—	breakContentScreen	call:settings.get	app/utils/displayManager.js:89
—	breakDuration	call:settings.get	app/breaksPlanner.js:28
—	breakHealthMode	call:settings.get	app/main.js:1035
—	breakIdeas	call:settings.get	app/main.js:1331
—	breakInterval	call:settings.get	app/breaksPlanner.js:133
—	breakNotification	call:settings.get	app/breaksPlanner.js:119
—	breakNotificationInterval	call:settings.get	app/breaksPlanner.js:120
—	breakPostponableDurationPercent	call:settings.get	app/main.js:993
—	breakPostpone	call:settings.get	app/main.js:994
—	breakPostponesLimit	call:settings.get	app/main.js:992
—	breakStartSoundPlaying	call:store.delete	app/main.js:345
—	breakStrictMode	call:settings.get	app/main.js:991
—	breakWindowHeight	call:settings.get	app/main.js:876
—	breakWindowWidth	call:settings.get	app/main.js:1045
—	checkNewVersion	call:settings.get	app/main.js:774
—	currentTimeInBreaks	call:window.settings.get	app/break-renderer.js:73
—	currentTimeInBreaksFontSize	call:window.settings.get	app/microbreak-renderer.js:77
—	currentTimeInBreaksFormat	call:window.settings.get	app/microbreak-renderer.js:73
—	disableAppUpdateFeatures	call:store.get	app/main.js:316
—	endBreakShortcut	call:settings.get	app/main.js:845
—	endBreakShortcut	call:window.settings.get	app/microbreak-renderer.js:65
—	forceX11OnWayland	call:settings.get	app/main.js:474
—	fullscreen	call:settings.get	app/main.js:952
api.github.com	https://api.github.com/repos/hovancik/stretchly/releases/latest	call:fetch	app/utils/versionChecker.js:3
—	ideas	call:settings.get	app/main.js:832
—	isFirstRun	call:settings.get	app/main.js:674
—	language	call:window.settings.get	app/break-renderer.js:72
—	language	call:settings.get	app/utils/statusMessages.js:27
—	longBreakAudio	call:store.get	app/main.js:342
—	longBreakManualFinish	call:settings.get	app/main.js:410
—	longBreakStartSound	call:settings.get	app/main.js:1007
—	mainColor	call:settings.get	app/main.js:1035
—	mainColor	call:window.settings.get	app/microbreak-renderer.js:23
—	microbreak	call:settings.get	app/breaksPlanner.js:117
—	microbreakDuration	call:settings.get	app/main.js:821
—	microbreakIdeas	call:settings.get	app/main.js:1332
—	microbreakInterval	call:settings.get	app/breaksPlanner.js:118
—	microbreakNotification	call:settings.get	app/breaksPlanner.js:296
—	microbreakNotificationInterval	call:settings.get	app/breaksPlanner.js:297
—	microbreakPostponableDurationPercent	call:settings.get	app/main.js:824
—	microbreakPostpone	call:settings.get	app/main.js:825
—	microbreakPostponesLimit	call:settings.get	app/main.js:823
—	microbreakStartSoundPlaying	call:store.delete	app/main.js:336
—	microbreakStrictMode	call:settings.get	app/main.js:258
—	miniBreakAudio	call:store.get	app/main.js:333
—	miniBreakColor	call:settings.get	app/main.js:865
—	miniBreakManualFinish	call:settings.get	app/main.js:401
—	miniBreakStartSound	call:settings.get	app/main.js:837
—	monitorDnd	call:settings.get	app/main.js:424
—	monitorDndCheckInterval	call:settings.get	app/utils/dndManager.js:16
—	morningHour	call:settings.get	app/utils/untilMorning.js:11
—	naturalBreaks	call:settings.get	app/breaksPlanner.js:236
—	naturalBreaksCheckInterval	call:settings.get	app/utils/naturalBreaksManager.js:11
—	naturalBreaksInactivityResetTime	call:settings.get	app/utils/naturalBreaksManager.js:56
—	notifyNewVersion	call:settings.get	app/main.js:777
—	opacity	call:settings.get	app/main.js:1322
—	openAtLogin	call:settings.get	app/main.js:442
—	pauseBreaksFor1HourShortcut	call:settings.get	app/main.js:1544
—	pauseBreaksFor2HoursShortcut	call:settings.get	app/main.js:1550
—	pauseBreaksFor30MinutesShortcut	call:settings.get	app/main.js:1538
—	pauseBreaksFor5HoursShortcut	call:settings.get	app/main.js:1556
—	pauseBreaksShortcut	call:store.get	app/main.js:293
—	pauseBreaksUntilMorningShortcut	call:settings.get	app/main.js:1562
—	pauseForSuspendOrLock	call:settings.get	app/main.js:557
—	posLatitude	call:settings.get	app/utils/untilMorning.js:15
—	posLongitude	call:settings.get	app/utils/untilMorning.js:16
—	resumeBreaksShortcut	call:store.delete	app/main.js:300
—	screen	call:settings.get	app/utils/displayManager.js:18
—	showBreakActionsInStrictMode	call:store.delete	app/main.js:308
—	showBreaksAsRegularWindows	call:settings.get	app/main.js:996
—	showTrayIcon	call:settings.get	app/main.js:1427
—	showTrayMenuInStrictMode	call:settings.get	app/main.js:1494
—	silentNotifications	call:settings.get	app/main.js:1190
—	themeSource	call:settings.get	app/main.js:489
—	timeToBreakInTray	call:store.delete	app/main.js:360
—	transparentMode	call:settings.get	app/main.js:1321
—	trayIconStyle	call:settings.get	app/main.js:633
—	trayIconThemeSource	call:settings.get	app/main.js:614
—	useIdeasFromSettings	call:settings.get	app/main.js:1330
—	useMonochromeInvertedTrayIcon	call:store.get	app/main.js:365
—	useMonochromeTrayIcon	call:settings.get	app/main.js:629
—	volume	call:settings.get	app/main.js:1192

Modules

Module	Used by
@napi-rs/canvas	graphics/time-intray-icon-generator.js
@particle/dbus-next	app/utils/dndManager.js, app/utils/flatpakPortalManager.js
auto-launch	app/utils/autostartManager.js
dompurify	app/utils/sanitizeIdea.js
electron	app/electron-bridge.mjs, app/main.js, app/utils/context-bridge-exposers.js, app/utils/displayManager.js, app/utils/naturalBreaksManager.js
electron-log/main.js	app/breaksPlanner.js, app/main.js, app/utils/appExclusionsManager.js, app/utils/autostartManager.js, app/utils/commands.js, app/utils/displayManager.js, app/utils/dndManager.js, app/utils/flatpakPortalManager.js, app/utils/naturalBreaksManager.js, app/utils/untilMorning.js
electron-store	app/main.js
events	app/breaksPlanner.js, app/utils/appExclusionsManager.js, app/utils/dndManager.js, app/utils/naturalBreaksManager.js
humanize-duration	app/main.js, app/utils/context-bridge-exposers.js
i18next	app/main.js
i18next-fs-backend	app/main.js
luxon	app/main.js, app/utils/untilMorning.js, app/utils/utils.js
meeussunmoon	app/utils/untilMorning.js
node-desktop-idle-v2	app/utils/naturalBreaksManager.js
node:child_process	app/utils/dndManager.js, graphics/time-intray-icon-generator.js
node:events	app/main.js
node:fs	app/main.js, app/utils/audioResolver.js, app/utils/imageResolver.js, app/utils/utils.js, graphics/time-intray-icon-generator.js
node:fs/promises	app/utils/dndManager.js
node:os	app/utils/dndManager.js
node:path	app/utils/dndManager.js
node:url	app/utils/audioResolver.js, app/utils/imageResolver.js
node:util	app/utils/dndManager.js
path	app/main.js, app/utils/audioResolver.js, app/utils/imageResolver.js, graphics/time-intray-icon-generator.js
png-to-ico	graphics/time-intray-icon-generator.js
ps-list	app/utils/appExclusionsManager.js
semver	app/utils/context-bridge-exposers.js
url	app/main.js, graphics/time-intray-icon-generator.js
vitest/config	vitest.config.ts
windows-focus-assist	app/utils/dndManager.js

Windows and IPC

Window	webPreferences
app/main.js:658	preload=process-preload.mjs, sandbox=false
app/main.js:737	preload=electron-bridge.mjs, sandbox=false
app/main.js:909	preload=microbreak-preload.mjs, sandbox=false
app/main.js:1390	preload=preferences-preload.mjs, sandbox=false
app/main.js:707	preload=contributor-preferences-preload.mjs, sandbox=false
app/main.js:676	preload=welcome-preload.mjs, sandbox=false
app/main.js:1079	preload=break-preload.mjs, sandbox=false
app/main.js:1805	preload=electron-bridge.mjs, sandbox=false

Channel	Side	Operation	Where
check-version	renderer	on	app/utils/context-bridge-exposers.js:87
close-current-window	renderer	send	app/utils/context-bridge-exposers.js:95
current-settings	renderer	invoke	app/electron-bridge.mjs:26
enable-contributor-preferences	renderer	on	app/utils/context-bridge-exposers.js:89
enter-manual-await	renderer	on	app/utils/context-bridge-exposers.js:39
finish-long-break	main	on	app/main.js:1661
finish-mini-break	main	on	app/main.js:1651
get-global-value	main	handle	app/main.js:122
get-version	renderer	invoke	app/utils/context-bridge-exposers.js:92
get-window-bounds	main	handle	app/main.js:1864
i18next-dir	renderer	invoke	app/utils/context-bridge-exposers.js:26
i18next-translate	renderer	invoke	app/utils/context-bridge-exposers.js:25
long-break-loaded	main	on	app/main.js:1119
mini-break-loaded	main	on	app/main.js:948
open-contributor-auth	renderer	send	app/utils/context-bridge-exposers.js:96
open-contributor-preferences	main	on	app/main.js:1795
open-preferences	renderer	send	app/utils/context-bridge-exposers.js:99
open-sync-preferences	renderer	send	app/utils/context-bridge-exposers.js:98
play-sound	main	on	app/main.js:1743
postpone-long-break	main	on	app/main.js:1646
postpone-mini-break	main	on	app/main.js:1641
request-finish-break	renderer	on	app/utils/context-bridge-exposers.js:37
request-postpone-break	renderer	on	app/utils/context-bridge-exposers.js:35
request-skip-break	renderer	on	app/utils/context-bridge-exposers.js:36
resolve-local-audio	main	handle	app/main.js:1883
resolve-local-image	main	handle	app/main.js:1878
restore-defaults	renderer	send	app/utils/context-bridge-exposers.js:94
restore-remote-settings	main	handle	app/main.js:1839
save-setting	renderer	send	app/utils/context-bridge-exposers.js:74
send-long-break-data	main	handle	app/main.js:1013
send-mini-break-data	main	handle	app/main.js:843
set-contributor	main	on	app/main.js:1783
set-global-value	main	on	app/main.js:118
set-window-size	main	on	app/main.js:1869
settings-get	renderer	invoke	app/utils/context-bridge-exposers.js:69
show-debug	main	handle	app/main.js:1747
show-notification	renderer	on	app/utils/context-bridge-exposers.js:85
translate	renderer	on	app/utils/context-bridge-exposers.js:81
update-tray	renderer	send	app/utils/context-bridge-exposers.js:102

Remote pages, data and packaging

No remote pages are loaded into app windows.

No on-device storage calls found.

No packaged executable was found, so Electron fuses were not read.

README badge

Maintainers can show this report in their README:

[![App X-Ray](https://Eliot5566.github.io/app-xray/apps/stretchly/badge.svg)](https://Eliot5566.github.io/app-xray/apps/stretchly/)

What this report cannot see

Source checkout: 49 test, story, build-tool and minified/generated files were left out. Rerun with --all-files to include them.
CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.
Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.
Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.
Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.
Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.
JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.
Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.
Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.
Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.
danger-color-tester.html has 1 inline JavaScript body starting at line 38 that was not analyzed; endpoints, storage, imports and other facts in it are absent from the evidence.