The problem
Anything in localStorage is readable by any JavaScript on the page, which means a single cross site scripting flaw turns it into an open safe. Storing a password, a full card number, or raw personal data there is a finding waiting for an auditor, and it creeps in casually, a developer caches a form value to be helpful, a debug build leaves data behind. The app works perfectly. The data is one injected script away from leaving.
The idea
localStorage is a glass box, anyone can see in. This makes sure nothing that belongs in a vault is sitting in the glass box.
What you will catch
- A password or card number cached in client storage
- Raw personal data left in storage by a helpful or debug feature
- A finding a security review will flag, caught before it ships
How it works
Kane CLI reads the keys and values in storage. You assert that no key holds an obviously sensitive item, the things that should never live in a place any script can read.
Run it now
Point this at your own app to scan its real storage.
kane-cli --tui
# then paste this objective:
Go to https://github.com and let the page fully load.
Assert: localStorage has no key named 'password', 'card_number' or 'ssn'.Or one line, for CI or sharing
kane-cli run "Go to https://github.com and let the page fully load.
Assert: localStorage has no key named 'password', 'card_number' or 'ssn'." --agentWhat prints
Example run. Your numbers will vary by site, build and run. The PASS / FAIL and the zeros are the stable result, the raw timings and counts are illustrative.
▶ navigate + read storage ok ▶ assert no sensitive keys 0 found ✓ PASS RESULT PASS exit 0 ~45s ~7 to 15 credits # a cached secret would print: ▶ assert no sensitive keys 1 found: "card_number" ✗ FAIL RESULT FAIL exit 1
Adapt it to your app
Go to <your app> and complete <a flow that handles sensitive data>.
Assert: localStorage has no key named "password", "card_number", "ssn" or "<your sensitive field>".Why it works
Kane CLI reads localStorage keys directly, so a check for sensitive key names runs in plain English. localStorage is origin scoped, so the scan reflects exactly what this site stored.
What it unlocks
A security best practice becomes a gate. Sensitive data in client storage fails the build the day it appears, instead of surfacing in a penetration test months later.
