Node Integration versus Remote Module/ContextBridge for Secure NW.js Production Builds

Goal: Select a method for exposing necessary Node.js functionality to the renderer process in an NW.js application that remains secure when the app loads remote content in production.

Constraints: The chosen approach must prevent code‑injection attacks, require an explicit whitelist of modules, and ensure that any preload script used to bridge Node APIs resolves correctly after the app is packaged into an ASAR archive. Current documentation does not clearly state whether the legacy remote module (still present in NW.js v0.50+) should be retained or if the newer contextBridge‑style API introduced in v0.55 is the preferred path for existing node‑webkit projects.

Should the deprecated remote module continue to be used for existing projects, or is the contextBridge approach recommended for new builds? How does the choice affect module whitelisting and preload script reliability in packaged ASAR archives? What documentation gaps need clarification to guide a safe migration?