Check out Security | Electron
If your app has no need for navigation, you can call
event.preventDefault()
in awill-navigate
handler. If you know which pages your app might navigate to, check the URL in the event handler and only let navigation occur if it matches the URLs you’re expecting.
Implementing a PIN-protected general blocker or even a regular block/allow list that way looks viable to me (Caveat: my knowledge of Electron is limited). Assuming that community plug-ins are sandboxed it would have to be a feature of the Obsidian core, though – correct?