Reviews an Electron desktop app before release. Paste the BrowserWindow options, the preload scripts, the ipcMain handlers, and the packaging and update configuration to find renderers with Node.js integration or no context isolation, preload bridges that expose ipcRenderer or a generic invoke to the page, IPC handlers that run commands or open paths the renderer names, shell.openExternal calls on untrusted URLs, unlimited navigation and new windows, missing Content Security Policy and permission handlers, fuses left on, and unsigned updates. Returns a verdict, a trust map, evidence-linked findings, the smallest fix in the app's code, and tests that prove it.