It fits apps with a public GitHub repository that publish builds to GitHub Releases and sign them. If your app is private, needs percentage based rollouts or needs authentication, you need a different source. Whichever you choose, know who can write to the place update files live.
What the service requires
The Electron updating guide describes update.electronjs.org as a free and open source web service that Electron apps can use to self update. Apps must:
- Run on macOS or Windows
- Have a public GitHub repository
- Publish builds to GitHub Releases
- Be code signed, which the guide says is required on macOS only
The four routes
| Route | What it is | Good fit | Delivery path to protect |
|---|---|---|---|
| Hosted service | Free service from the Electron team | Public open source apps | Your GitHub release permissions |
| Static storage | A folder with release metadata, via the autoUpdater pointing to a static URL | Small teams wanting control | Who can write to the bucket |
| Third party server | A vendor run update server | Teams that want a managed service | The vendor and your account |
| Custom Squirrel compatible server | Your own server | Rollouts, channels, authentication | Your server and its keys |
The guide notes that running your own server allows percentage based rollouts, though it does not describe how to configure them. It calls Electron's built in autoUpdater, built on Squirrel, the easiest and officially supported option.
Questions to settle before you choose
- Who can publish a release? Count the accounts and tokens with write access. Require strong authentication and review their use.
- Where do signing keys live? Keep them off the update host.
- Do you need staged rollouts? If yes, the hosted service may not fit.
- Is your repository public? The hosted service needs it to be.
- How will you pull a bad release? Know the steps before you need them.
The signing dependency
On macOS the Electron docs say the autoUpdater depends on a signed app. Signing proves who built the app, but an attacker with release access plus your signing key defeats it, so protect both.
Try it yourself
The demo shows how gates apply rules to changes before they land. Think about how a similar rule, like requiring review for release publishing, could protect your update source.
Click through it at your own pace, or open it full screen.
Quick check
Can a private repository use update.electronjs.org?
According to the guide, apps need a public GitHub repository.
Is HTTPS mandatory for the autoUpdater?
The guide does not state it as mandatory, but its examples use HTTPS and you should too.
Safeguard's policies, gates and SBOM scanning help check a release before it reaches your update source. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
