1. Control lifecycle scripts with @lavamoat/allow-scripts

2. Do local dev with https://github.com/lavamoat/kipuka installed (I'm working on it)

3. If you don't permit the APIs used for loading DLLs they won't load themselves, so runtime protections are valid too. But I recall the DLLs were loaded in lifecycle script.

Thanks will check both out!