diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d15f377..00474b0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/package-lock.json b/package-lock.json
index 312bbaa..1aa2e54 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -729,9 +729,9 @@
       "link": true
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.12",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.12.tgz",
-      "integrity": "sha512-txsUW4SQ1iilgE0l9/e9VQWmELXifEFvmdA1j6WFh/aFPj99hIntrSsq/if0UWyGVkmrRPKA1wCeP+UCr1B9Uw==",
+      "version": "1.19.13",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
+      "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18.14.1"
@@ -3589,9 +3589,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.10",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.10.tgz",
-      "integrity": "sha512-mx/p18PLy5og9ufies2GOSUqep98Td9q4i/EF6X7yJgAiIopxqdfIO3jbqsi3jRgTgw88jMDEzVKi+V2EF+27w==",
+      "version": "4.12.12",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.12.tgz",
+      "integrity": "sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
diff --git a/packages/cli/src/desktop/electron-app.ts b/packages/cli/src/desktop/electron-app.ts
index 8bef300..0c02024 100644
--- a/packages/cli/src/desktop/electron-app.ts
+++ b/packages/cli/src/desktop/electron-app.ts
@@ -124,10 +124,10 @@ export async function getElectronUIStructure(session: ElectronSession): Promise<
         const value = element.getAttribute(attr);
         if (!value) continue;
         if (attr === "id") return "#" + CSS.escape(value);
-        return "[" + attr + "=\"" + value.replace(/"/g, '\\"') + "\"]";
+        return "[" + attr + "=\"" + value.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + "\"]";
       }
       if (element.tagName === "A" && element.getAttribute("href")) {
-        return "a[href=\"" + element.getAttribute("href")!.replace(/"/g, '\\"') + "\"]";
+        return "a[href=\"" + element.getAttribute("href")!.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + "\"]";
       }
       return null;
     };