Security

Status: Stable (guidance)

Previous: Browser support · Next: Changelog

Trust boundary

Anything in localStorage / sessionStorage is readable by scripts on the origin. XSS can read and write your envelopes.

Storage does not encrypt, isolate tenants beyond namespace prefixes, or protect against same-origin script.

Guidance

• Do not store passwords, tokens, or secrets
• TTL / schemaVersion are not security controls
• Treat snapshot JSON and diagnostics activity (keys) as sensitive
• Sanitize before injecting stored strings into the DOM

Encryption-at-rest is opt-in via @jayoncode/storage/transforms — defaults stay plaintext. Key material stays app-owned; XSS can still reach in-memory keys.

See also: browser-support.md · faq.md · transforms.md