security: disable nodeIntegration in mainWindow #9979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

jackkav wants to merge 9 commits into Kong:develop from jackkav:spike/full-disable

Closed

security: disable nodeIntegration in mainWindow #9979

Remove renderer node-import baseline checks

GitHub Advanced Security / Semgrep OSS failed May 29, 2026 in 2s

2 new alerts including 2 errors

New alerts in code changed by this pull request

2 errors

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 25 in packages/insomnia/src/utils/vault-crypto.ts

Code scanning / Semgrep OSS

Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv Error

The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.

Check failure on line 43 in packages/insomnia/src/utils/vault-crypto.ts

Code scanning / Semgrep OSS

Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv Error

The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.