It's _possible_ to build a secure Electron app, but it's also very easy to build an insecure Electron app. Even if you follow best practices regarding context isolation, it's very easy to introduce a subtle security issue like

    contextBridge.exposeInMainWorld('myAPI', {
      send: ipcRenderer.send
    })