- Enable contextIsolation, disable nodeIntegration, remove enableRemoteModule
- Add preload.js with safe contextBridge API exposure
- Fix OS command injection: exec() → execFile() in open-file-in-player
- Fix DOM XSS: replace innerHTML with textContent/createElement in FileListManager, UIManager, ModalManager
- Remove direct fs/electron access from renderer, route through IPC
- Add validate-folder and get-file-stats IPC handlers
- Load renderer modules via script tags with require polyfill
- Split large renderer.js file into 8 separate class files:
- AppState.js: Manages application state
- FileListManager.js: Handles file list display and manipulation
- TagManager.js: Manages file tagging functionality
- EpisodeManager.js: Handles episode number editing and highlighting
- SearchManager.js: Manages TVDB search and show selection
- FileManager.js: Handles file operations
- ModalManager.js: Manages video preview modal
- ProgressManager.js: Manages progress display
- UIManager.js: Main coordinator for UI functionality
- Follows SOLID principles and single responsibility
- Improves code maintainability and testability
- All syntax verified with node --check
