作者在 Mac 上檢查 Claude、Cursor、Postman 的 Electron 安全開關，結果分別為 6/6、0/6、1/6

Three popular desktop apps run on the same framework, Electron, but lock it down very differently. On my Mac, Claude 3.1623.0 turned on all six hardening switches I checked, Postman 11.93.0 turned on one, and Cursor 3.1.15 turned on none.

Those switches decide whether another program on your machine can quietly run code with the app's identity, permissions and signed-in sessions. Checking them took one read-only command per app and no special access.

What Electron fuses are

Fuses are on/off switches written into an Electron app's framework binary when the app is packaged. Unlike settings in the app's code, they can't be changed at runtime, so they are a cheap, reliable way to remove risky features before shipping.

The six I checked, and the safe setting for each:

Electron's own security guidance recommends this hardened configuration; it is not the framework's default, so each vendor has to opt in.

How I checked

I used REA (Reverse Engineer Anything), an open-source MCP server, driven from Claude Code. Its inspect_electron_fuses tool finds the fuse block inside each app's Electron Framework binary and reports every fuse's raw byte.

• Read-only: it reads the shipped files; it doesn't launch, modify or bypass anything.
• Every architecture: Claude and Cursor ship universal binaries; the x86_64 and arm64 slices matched.
• Reproducible: each result carries the binary's SHA-256 and the fuse block's file offset, so anyone with the same version can verify it.

Versions tested on macOS 15.1 on October 21, 2026: Claude 3.1623.0, Cursor 3.1.15, Postman 11.93.0 (arm64 build).

Results

Claude passed every check, Postman passed one, and Cursor passed none.

• Claude ships the full hardened set, plus a newer ninth fuse (WasmTrapHandlers) that the other two binaries don't define.
• Cursor leaves every switch at its permissive setting, including debugger attachment through --inspect.
• Postman blocks --inspect but leaves the other five open.

All three leave GrantFileProtocolExtraPrivileges on; I left it out of the score because disabling it can break apps that load local files.

What it actually means

These gaps don't let anyone break into your Mac; an attacker already needs code running as your user. What they change is what that code can do next.

• Borrowed identity: code started through a permissive app runs as that signed app, so it can inherit macOS permissions you granted the app (files, camera, microphone) instead of triggering a fresh prompt.
• Quiet persistence: with integrity checks off, modified app code can load without warning the next time you open the app.
• Session exposure: with cookie encryption off, the app's stored web sessions are easier to read off disk.

The Cursor result has context. It's built on VS Code, whose extension host has historically depended on running Electron as Node, so turning RunAsNode off isn't a one-line change. That explains it; it doesn't make the other five settings necessary.

Vendors usually rate this class as low severity, and I agree it's hardening rather than an emergency. It still matters for an AI code editor and an API client: both hold source code, API keys and tokens.

Check your own apps

You can run the same check in a minute, with or without an AI agent.

1. Find Electron apps: any app with Contents/Frameworks/Electron Framework.framework inside its bundle is Electron.
2. Read the fuses: npx @electron/fuses read --app /Applications/<App>.app, or ask an agent with REA installed to run inspect_electron_fuses on the app.
3. Compare against the safe settings in the table above.

If you ship an Electron app, flip the fuses at package time with @electron/fuses (Electron Forge and electron-builder both support it). Turn on ASAR integrity and OnlyLoadAppFromAsar together, and test your auto-updater and any native modules after each change.

What's next

This is the first in a series of teardowns of everyday desktop apps. Next, I'll follow how one of these apps moves data between its web page and the operating system, through the preload script and IPC.

If you build an Electron app and want the same check run on it, with a short report, get in touch. Subscribe to get the next teardown.

Sources

• REA (Reverse Engineer Anything) on GitHub
• Electron fuses documentation
• @electron/fuses on npm