fix(security): replace global TLS bypass with scoped certificate-error handler

[khawarahemad]

Summary

This PR removes the process-global Chromium switch ignore-certificate-errors and replaces it with a scoped app.on("certificate-error") handler.

Impact

The --ignore-certificate-errors command-line switch disabled TLS certificate validation globally across all Chromium network requests. Any external HTTPS traffic (such as CDN scripts loaded in the Monaco Config Editor) was vulnerable to network transit interception (MITM).

Root Cause

app.commandLine.appendSwitch("ignore-certificate-errors") applied universally to all network connections instead of being restricted to localhost self-signed certificates.

Fix

Removed the global command-line flag and implemented app.on("certificate-error") inside app.whenReady(). The handler explicitly verifies that the requested URL's hostname matches Constants.CustomDiscordDomain, localhost, or 127.0.0.1 before trusting the certificate, preserving standard PKI validation for all external remote domains.

Validation

• Validated with npm run test:typescript and npm run build:ts.
• Verified that local self-signed endpoints connect properly while external HTTPS URLs strictly enforce valid TLS certificates.

[aiko-chan-ai]

I'll review this PR later, it's already quite late over here 🥲

[Copilot]

🟡 Changes recommended

The new certificate-error allowlist currently permits invalid certificates for a public domain (discord.com via Constants.CustomDiscordDomain), which materially weakens the intended TLS security posture if host mapping is bypassed or changes later.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR removes a process-wide Chromium TLS bypass (ignore-certificate-errors) and replaces it with a scoped Electron app.on("certificate-error") handler intended to only trust local/self-signed endpoints, reducing MITM exposure for external HTTPS traffic.

Changes:

• Removed the global ignore-certificate-errors Chromium switch and introduced a certificate-error event handler to selectively allow specific hostnames.
• Adjusted Express request type augmentation to use declare global { namespace Express { ... } }.
• Made Vencord extension loading resilient by checking for existence and handling load failures with logging.

File summaries

File	Description
src/overrides.d.ts	Updates Express Request type augmentation approach while preserving custom fields.
src/AppCore/index.ts	Replaces global TLS bypass with a certificate-error handler and hardens extension loading behavior/logging.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[khawarahemad]

Thanks for the review feedback. I investigated the certificate handling further and found an important detail.

Constants.CustomDiscordDomain is discord.com, while the application uses Electron host-rules to map that hostname to the local HTTPS server.

The current certificate-error handler therefore trusts any certificate error for discord.com, rather than proving that the certificate belongs to the self-signed certificate generated by the application.

That means the hostname-only check is broader than intended if the host mapping is ever bypassed or does not apply to a particular request.

The local HTTPS server certificate is generated at runtime by Utils.generateSelfSignedCertificate(). A safer implementation would scope the exception to the application's actual local certificate, for example by validating the certificate identity/fingerprint in addition to the expected local endpoint.

I haven't changed the PR yet because I wanted to confirm the intended certificate trust model with you first.