Summary

Enable Electron’s webSecurity setting in release builds only.

Problem it solves

MarkText currently disables Chromium’s same-origin protections in production. Electron’s official security checklist explicitly recommends: “Do not disable webSecurity.”

No release-mode regressions were observed in automated testing with webSecurity: true. The flag seems to have been disabled in the original Aidou/Doutu image-search change, which made cross-origin requests but was removed meanwhile.

Development still requires the setting to remain disabled for document-local images.

Proposed solution

Set webSecurity: true in release builds while preserving the existing development behavior. Apply the change to both editor and preferences windows.