fix(security): replace localStorage with sessionStorage for sensitive chat data

Author: tembo[bot]

apps/web/src/components/app-sidebar.tsx

@@ -265,22 +265,22 @@ export function AppSidebar({
   useEffect(() => {
     if (typeof window === "undefined") return;
     try {
-      const stored = localStorage.getItem(CHATS_CACHE_KEY);
+      const stored = sessionStorage.getItem(CHATS_CACHE_KEY);
       if (stored && !cachedChatsRef.current) {
         cachedChatsRef.current = JSON.parse(stored);
       }
     } catch (e) {
-      console.warn("Failed to load chats from localStorage:", e);
+      console.warn("Failed to load chats from sessionStorage:", e);
     }
   }, []);
 
   useEffect(() => {
     if (chatsResult?.chats && chatsResult.chats.length > 0) {
       cachedChatsRef.current = chatsResult.chats;
       try {
-        localStorage.setItem(CHATS_CACHE_KEY, JSON.stringify(chatsResult.chats));
+        sessionStorage.setItem(CHATS_CACHE_KEY, JSON.stringify(chatsResult.chats));
       } catch (e) {
-        console.warn("Failed to save chats to localStorage:", e);
+        console.warn("Failed to save chats to sessionStorage:", e);
       }
     }
   }, [chatsResult?.chats]);

apps/web/src/lib/auth-client.tsx

@@ -253,10 +253,28 @@ export async function signUpWithEmail(
   });
 }
 
+/**
+ * Sensitive sessionStorage keys that store chat content, drafts, and stream data.
+ * These must be cleared on sign-out to prevent data leakage on shared devices.
+ */
+const SENSITIVE_SESSION_KEYS = [
+  "openchat-chats-cache",
+  "openchat-prompt-drafts",
+  "openchat-stream",
+];
+
 export async function signOut() {
   return authClient.signOut({
     fetchOptions: {
       onSuccess: () => {
+        // Clear sensitive chat/draft/stream data from sessionStorage
+        for (const key of SENSITIVE_SESSION_KEYS) {
+          try {
+            sessionStorage.removeItem(key);
+          } catch {
+            // Ignore storage access errors
+          }
+        }
         window.location.href = "/auth/sign-in";
       },
     },

apps/web/src/stores/prompt-draft.ts

@@ -2,12 +2,16 @@ import { create } from "zustand";
 import { createJSONStorage, devtools, persist } from "zustand/middleware";
 
 /**
- * Store for persisting prompt drafts across page reloads.
+ * Store for persisting prompt drafts within the current browser session.
+ *
+ * Uses sessionStorage instead of localStorage to limit exposure of sensitive
+ * chat content — data is scoped to the tab/session and not accessible after
+ * the browser session ends.
  *
  * Non-annoying approach:
  * - Drafts are saved per-chat (or "global" for new chat input)
  * - Drafts are automatically cleared when a message is sent
- * - Old drafts are cleaned up after 7 days to prevent localStorage bloat
+ * - Old drafts are cleaned up after 7 days to prevent storage bloat
  */
 
 const DRAFT_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
@@ -115,7 +119,7 @@ export const usePromptDraftStore = create<PromptDraftState>()(
 			}),
 			{
 				name: "openchat-prompt-drafts",
-				storage: createJSONStorage(() => localStorage),
+				storage: createJSONStorage(() => sessionStorage),
 			},
 		),
 		{ name: "prompt-draft-store" },

apps/web/src/stores/stream.ts

@@ -204,7 +204,7 @@ export const useStreamStore = create<StreamState>()(
       }),
 		{
 			name: "openchat-stream",
-			storage: createJSONStorage(() => localStorage),
+			storage: createJSONStorage(() => sessionStorage),
 			partialize: (state) => ({
 				activeStream: state.activeStream,
 				pendingUserMessage: state.pendingUserMessage,