Severity
Medium — tokens travel to contexts that don't need them.
What happens
The ORG_LIST handler returns Object.values(orgs) — full SalesforceOrg objects including accessToken — consumed via sf.listOrgs() by OrgSwitcher/OrgPicker and several screens, which also render inside the content-script world of Salesforce pages. Tokens never need to leave the background worker.
Evidence
src/background/index.ts:991-999
Suggested fix
Map to {orgId, username, instanceUrl, displayName, environment} before responding.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).
Severity
Medium — tokens travel to contexts that don't need them.
What happens
The
ORG_LISThandler returnsObject.values(orgs)— fullSalesforceOrgobjects includingaccessToken— consumed viasf.listOrgs()by OrgSwitcher/OrgPicker and several screens, which also render inside the content-script world of Salesforce pages. Tokens never need to leave the background worker.Evidence
src/background/index.ts:991-999Suggested fix
Map to
{orgId, username, instanceUrl, displayName, environment}before responding.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).