Coinpoker Desktop Client Security

**Report: Security Assessment of CoinPoker's New Desktop Client (Launched ~March 2, 2026)**

**Overview**
CoinPoker launched a major platform upgrade on March 2, 2026, including a completely rebuilt desktop client for Windows and macOS (native apps, no longer browser-only for desktop). This is described officially as a "ground-up rebuild" with improved performance, scalability, new game formats, full rakeback promotions, and "enhanced security protocols." The client is Electron-based (Chromium + Node.js framework), common for cross-platform poker apps but prone to misconfiguration risks.

**Key Security Concerns Identified**
Multiple X posts (from March 3, 2026) and community discussions highlight serious Electron configuration issues in the new client:

- **Disabled Chromium sandbox** (`sandbox: false` or equivalent) — Prevents isolation of renderer processes; exploits in web content can escape to the host OS.
- **webSecurity: false** — Disables same-origin policy, CORS protections, and other browser-like safeguards.
- **Insecure combinations** like `nodeIntegration: true` (or legacy equivalents) + `contextIsolation: false` — Allows untrusted JavaScript in renderers direct access to Node.js APIs (filesystem, child processes, OS commands, crypto keys, etc.).

These settings are widely regarded as dangerous in Electron apps, especially those handling cryptocurrency, wallets, private keys, or financial data. Electron's official security guidelines (as of recent versions) strongly recommend:
- `sandbox: true` for renderers
- `contextIsolation: true`
- `nodeIntegration: false`

Disabling them turns common web vulnerabilities (XSS, malicious loaded content, compromised dependencies, or even injected overlays) into potential full system compromise (RCE — remote code execution). Historical Electron audits show most popular apps disable these protections, leading to elevated risk.

**Evidence from Public Sources**
- Security researcher @wolfsec0x0 (cybersecurity pro + poker player) posted that the app has "major security risks" enabling easy exploitation, plus unintended source code exposure (multiple issues found via basic reverse engineering).
- Poker personality @CaitlinComeskey warned users to delete the software immediately due to a "massive security flaw" allowing hacker access to computers.
- Other posts reference similar Electron pitfalls in crypto/wallet contexts (e.g., XSS → key theft).

No public proof-of-concept exploit against CoinPoker specifically exists yet (as of March 3, 2026), but the config alone is considered a severe red flag — not a minor issue.

**CoinPoker's Official / Team Response**
- Ambassador/team member @mariomosboeck stated there are "no massive security flaws."
- Described the report as a "quick AI out - no proper report."
- Claimed the tech team reviewed and double-checked feedback, takes it "extremely serious," and welcomes more input.
- No detailed technical rebuttal (e.g., explaining why flags are safe in their setup, patched version, or mitigation details) has appeared publicly yet.
- Official announcements emphasize "enhanced security" in the rebuild but provide no specifics on Electron hardening.

**Context & Mitigating Factors**
- The client uses white-label poker software licensed to multiple operators (not fully custom CoinPoker code), which may explain inherited insecure defaults.
- No confirmed breaches, wallet drains, or exploits targeting CoinPoker users from this issue (as of now).
- The platform holds an Anjouan license, uses certified RNG, and has no major historical security incidents per reviews.
- Browser play (or mobile) remains unaffected by desktop Electron risks.

**Risk Level & Recommendations**
**High risk for desktop client users**, particularly those:
- Holding significant crypto balances
- Using the app on machines with other wallets/keys
- Concerned about targeted attacks (common in crypto poker)

**Current status (March 3, 2026)**: The insecure flags appear real based on screenshots/shared analysis. Without a patched release (with sandbox enabled, contextIsolation on, etc.) and public confirmation (e.g., updated build notes or third-party audit), treat the desktop app as unnecessarily vulnerable.

**Advice**:
- Avoid the new desktop client until fixes are released and verified.
- Use browser version if possible (less attack surface).
- If already installed: Consider uninstalling, monitoring for suspicious activity, and scanning systems (though no active exploit is confirmed).
- Watch CoinPoker's official channels (@CoinPoker_com, site announcements) for updates/patches.
- For high-value accounts: Treat any Electron poker/crypto app with disabled sandbox as high-risk by default — industry norm is poor here.

This situation reflects broader Electron ecosystem problems (many apps ship insecure by default), amplified by crypto stakes. CoinPoker may address it quickly given visibility, but right now the concerns are substantiated and unresolved.