Is your feature request related to a problem? Please describe.

Electron is known for being insecure. It should come with better security defaults.

Describe the solution you'd like

The Electron security checklist recommends disallowing permission requests for features the app doesn't need. It's a big security gap that this is opt-out rather than opt-in.

I recommend making all permission requests denied by default and let the user instead explicitly opt into what they need. That's also how Chrome works.

So the default would become something like this:

const {session} = require('electron');

session.defaultSession.setPermissionRequestHandler((webContents, permission, callback) => {
	callback(false);
});