221
context isolation
also nodeIntegration off, contextBridge
The page cannot see Node, even if it is compromised.
What is context isolation?
Context isolation runs the page and the preload in separate JavaScript worlds. nodeIntegration stays off. The preload exposes a small object with contextBridge. Without isolation, a cross-site script in the window can require the filesystem.
Why does context isolation matter when vibe coding?
Templates turn isolation off because a tutorial from 2018 did, or because a library “needs Node.” The demo works. The threat model is gone.
How do you do context isolation?
contextIsolation true, nodeIntegration false, sandbox true. Expose methods, not modules. Remote content gets a separate window with no bridge.
How do you ask a model for context isolation?
Enable context isolation and disable nodeIntegration for (window). Expose (methods) through contextBridge only. Do not turn isolation off to unblock a library.
What goes wrong with context isolation?
A “dev only” exception that the production build still ships.