- Enable contextIsolation, disable nodeIntegration, remove enableRemoteModule
- Add preload.js with safe contextBridge API exposure
- Fix OS command injection: exec() → execFile() in open-file-in-player
- Fix DOM XSS: replace innerHTML with textContent/createElement in FileListManager, UIManager, ModalManager
- Remove direct fs/electron access from renderer, route through IPC
- Add validate-folder and get-file-stats IPC handlers
- Load renderer modules via script tags with require polyfill
