[Security] Salesforce session tokens persisted unencrypted in chrome.storage.local #64

Severity

High.

What happens

saveOrg stores the full SalesforceOrg including accessToken in chrome.storage.local — the sid lands unencrypted on disk and survives browser restarts. This contradicts the same file's own docstring ("session: ephemeral data such as active tokens") and the checkpoint comment "credentials … remain session/file scoped". setSessionToken (session-scoped) exists but is written in addition to, not instead of, local storage.

Evidence

• src/services/storage/index.ts:44-48 (and docstring line 11, comment line 641)
• Call sites: src/background/index.ts:52, 86, 1019, 1043, 1062, 1961, 2277

Suggested fix

Strip accessToken/tokenExpiresAt before saveOrg and re-derive from cookies on demand (loginForTab already does this), or keep tokens only in chrome.storage.session.

Environment

Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).