Security review remediation: preload/WebSocket/swap DB hardening + wallet directory fix

[Alexsanchez06]

Summary

Hardens the wallet's internal WebSocket server, swap transaction storage,
external link handling, and swap currency icon loading, and fixes a Windows
crash on wallet directory creation.

Preload bridge / external links

• shell.openExternal (preload and main process) now only allows https:
  targets, closing an file:///UNC/custom-protocol code-execution vector.

WebSocket internal server (backend.js, src/gateway/gateway.js)

• Bound to 127.0.0.1 instead of all interfaces.
• receive() wrapped in try/catch so a malformed frame can't crash the process.
• maxPayload raised from 1MB to 50MB — the original cap silently broke large
  CSV exports (swap/transaction history).
• Added a verifyClient origin check so a stray local browser tab can't open
  a connection to the app's internal socket.
• The renderer side (gateway.js) now actually reconnects with backoff on an
  unexpected disconnect, plus an error listener and a readyState guard on
  send(), instead of silently staying dead.

Swap history storage (swap_db.js)

• Sensitive columns (pay-in/pay-out/refund addresses, memos, raw provider
  response) are now encrypted at rest via Electron's safeStorage, with a
  version-prefixed marker so existing plaintext rows keep working unchanged.
• Database location on macOS/Linux moved from a plain ~/Beldex to a proper
  app-data folder, with migration; the -wal/-shm sidecar files now move
  together with the main .db file (previously left behind).
• Directory/file permissions are now restricted immediately after creation
  rather than after tables are written.

Swap currency icons / CSP (currencyDropDown.vue, electron-main.js,

index.template.html)

• safeImageSrc and the CSP img-src directive now only allow
  changelly.com/quickex.io (with subdomains) instead of any HTTPS host,
  closing a potential image-based tracking/beacon vector.

Wallet directory creation (backend.js)

• Windows EPERM crash when the wallet data folder can't be created
  (e.g. blocked by Controlled Folder Access) is now handled gracefully:
  retry, then an explicit user consent prompt that requests a one-time
  elevated exemption, falling back to a clean error instead of crashing.

  Testing

• All touched files pass node --check.

• Each fix was reviewed line-by-line against the specific behavior it's
  meant to close, not just assumed to work from the diff.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 73b0784a-c692-455f-a5a2-f319fae96981

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}