No tokens in localStorage without reason

no-tokens-in-localstorage-without-reasonDeterministic

Session tokens are not kept in localStorage unless a documented reason exists.

v1.0.2 · current

Version 1.0.2

Implementation sha256 Published CWE-922

Verifies: No browser code stores a session credential (access, refresh or id token, JWT, session id, API key) in localStorage or sessionStorage without a documented reason next to the write.
Inputs: Non-test JavaScript and TypeScript files of the checkout that touch the browser (localStorage, sessionStorage, window, document, or a client-side path). Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: Not applicable when the checkout has no browser-side JavaScript or TypeScript. A localStorage write (setItem, bracket or property assignment) whose key or value names a session credential is HIGH, and so is an Authorization header built from localStorage; the same on sessionStorage is MEDIUM (blocks in Extended suites). A write is documented, and reported as LOW only, when the line or the three lines above carry a comment with reason, justification, accepted risk, rationale, because or why. Preference keys (theme, locale, consent, cart) never count. PASS when the browser files were scanned and no undocumented credential write was found.
Type: deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)

const STORAGE_WRITE = /\b(localStorage|sessionStorage)\s*(?:\.\s*setItem\s*\(\s*([^,\n]+)\s*,|\[\s*([^\]\n]+)\s*\]\s*=|\.\s*(\w+)\s*=)/g;

// localStorage + credential key and no comment with reason|justification|accepted risk within 3 lines -> FAIL; sessionStorage -> MEDIUM

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.