[NewsAware]

Seeing that electron application code can easily be inspected inside the asar container (I.e. you can't trust the client) :

How would you approach the problem to encrypt secrets locally? The only approach I could come up with involves receiving a symmetric key from a server with certificate pinning, but even that seems quite insecure).

[slantyyz]

For some use cases, you can use Keytar (https://github.com/atom/node-keytar) which uses the credential system/keychain on the OS.