Severity
High.
What happens
saveOrg stores the full SalesforceOrg including accessToken in chrome.storage.local — the sid lands unencrypted on disk and survives browser restarts. This contradicts the same file's own docstring ("session: ephemeral data such as active tokens") and the checkpoint comment "credentials … remain session/file scoped". setSessionToken (session-scoped) exists but is written in addition to, not instead of, local storage.
Evidence
src/services/storage/index.ts:44-48 (and docstring line 11, comment line 641)- Call sites:
src/background/index.ts:52, 86, 1019, 1043, 1062, 1961, 2277
Suggested fix
Strip accessToken/tokenExpiresAt before saveOrg and re-derive from cookies on demand (loginForTab already does this), or keep tokens only in chrome.storage.session.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).
Severity
High.
What happens
saveOrgstores the fullSalesforceOrgincludingaccessTokeninchrome.storage.local— the sid lands unencrypted on disk and survives browser restarts. This contradicts the same file's own docstring ("session: ephemeral data such as active tokens") and the checkpoint comment "credentials … remain session/file scoped".setSessionToken(session-scoped) exists but is written in addition to, not instead of, local storage.Evidence
src/services/storage/index.ts:44-48(and docstring line 11, comment line 641)src/background/index.ts:52, 86, 1019, 1043, 1062, 1961, 2277Suggested fix
Strip
accessToken/tokenExpiresAtbeforesaveOrgand re-derive from cookies on demand (loginForTabalready does this), or keep tokens only inchrome.storage.session.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).