Native desktop access needs explicit trust boundaries

A desktop window that can read local files carries responsibilities beyond displaying ordinary web content.

I expose narrow operations to interfaces instead of granting unrestricted access to operating system capabilities.

Electron guidance rejects Node.js integration for remote content and recommends validating IPC senders.

Tauri capabilities constrain frontend exposure, but registered application commands are not universally denied by default.

Since Desktop runtime choices trade package size for rendering control, security configuration must follow the selected runtime.

Because Desktop performance claims need workload measurements, optimization must preserve these boundaries rather than bypassing them.

A file import should validate its inputs and authorize its scope before performing privileged work.

Keep sensitive operations explicit, reviewable, and limited to the access each workflow genuinely requires.