Securing Electron Applications with OpenID Connect and OAuth 2.0

Thanks for the article!
Given electron lets you execute custom code on the browser windows, don’t the electron app developers have the power to capture the auth0 credentials?
Shouldn’t the oauth flow be happening on the browser itself?
Thanks!