Showcase: App X-Ray — a shareable "ingredients label" for Electron apps, built on REA

[Eliot5566]

I built App X-Ray on top of REA (rea-agents 6.7.0, pinned) and wanted to share it as a case, following the README's invitation.

Target. The source of 20 open-source Electron apps, including Signal Desktop, Joplin, GitHub Desktop, Bitwarden, Element, Insomnia, Etcher and Hyper, each at a pinned commit. The weekly gallery is at https://eliot5566.github.io/app-xray/.

Question. What is in this app, and is any of it risky? That covers which Electron version it ships and whether that version still gets security fixes, its window security settings (nodeIntegration, contextIsolation, sandbox), the IPC channels its main process handles, its preload scripts, and the network addresses written in its code. The answer should fit in one page anyone can share, with every claim linked to a file and line.

How REA helped.

rea analyze-javascript-application --json does the heavy lifting. App X-Ray turns its evidence (modules, BrowserWindow options, IPC registrations, string literals) into a fixed report schema and runs about 10 rules over it.
inspect-electron-fuses reads fuse state from packaged apps (Windows/Linux executables and the macOS framework).
Because REA's output carries source locations, every finding in the HTML report links back to the line it came from.
For large apps, App X-Ray splits the files into parallel REA batches in the same folder, so imports still resolve. With this, 18 of the 20 apps scan in under 60 seconds on a 4-core container. Signal Desktop, at about 2,100 files and 12.9 MB, takes about 2 minutes.
What we found (week of 2026-10-23, static analysis only).

Electron version: found for all 20 apps.
Out-of-support Electron: 7 of 20 apps were on an Electron major that no longer gets security fixes.
nodeIntegration: true together with contextIsolation: false: found in at least one window of 5 apps.
IPC handlers: 14 of 20 apps register handlers that never check the sender.
These are statements about what the code contains, not what the apps send or do at runtime.

Built on top.

xray diff and a GitHub Action post a PR comment whenever a change adds servers, packages, tracking services or weaker window settings.
REA-Bench (in review) asks agents factual questions about the same apps and grades them against the reports, to compare runs with REA's tools against runs without them.
App X-Ray only reads files. It never runs the target, and it only publishes reports for open-source apps. Feedback is very welcome, especially on how App X-Ray maps REA's evidence.