[SECURITY] GitHub personal access tokens stored in plaintext browser localStorage are accessible to any JavaScript running on the page

[anshul23102]

Problem

If the dashboard stores the GitHub OAuth access token or personal access token in localStorage, it is accessible to any JavaScript running on the same origin, including third-party scripts, browser extensions, and any XSS payload. This allows a successful XSS attack to silently exfiltrate the token and gain full access to the user's GitHub account with the granted scopes.

Steps to Reproduce

1. Authenticate with GitHub
2. Open the browser console and run: localStorage.getItem("gh_token") (or check all localStorage keys for any token-like value)
3. If a token is found, confirm it is a valid GitHub token by calling https://api.github.com/user with it as a Bearer token

Proposed Fix

• Store tokens exclusively in HTTP-only, Secure, SameSite=Strict cookies set by the server. These are invisible to JavaScript and safe from XSS exfiltration
• If client-side token storage is required, use sessionStorage with a short expiry and rotate tokens frequently
• Audit all localStorage.setItem() calls to confirm no sensitive values are stored there

Complexity: Level 3 | Program: GSSOC '26

[BCA-krishna]

Hi @Priyanshu-byte-coder , I'd like to work on this security issue as part of GSSoC '26.

I have reviewed the issue and understand the security implications of storing GitHub access tokens in localStorage. I plan to audit the authentication flow, identify any sensitive data being stored client-side, and migrate token storage to a more secure approach (preferably HTTP-only, Secure, SameSite cookies where applicable). I'll also verify that no sensitive values are persisted in localStorage and update the authentication flow accordingly while maintaining compatibility.

Could you please assign this issue to me? Thank you!

[github-actions]

Assigned to @BCA-krishna! You have 7 days to open a PR. No PR after 7 days = auto-unassigned so others can pick it up. Good luck!

[anshul23102]

/assign

Claiming this issue for GSSoC '26. Please assign it to me, I'll start working on it right away.