Security audits have highlighted a security concern with the current conversation history persistence mechanism.
When local storage history is enabled, Tock stores the conversation history in clear text in the browser's localStorage. This means that malicious browser extensions, injected scripts, or other code with access to the application's storage can potentially retrieve the full conversation history, including potentially sensitive information.
The history should therefore not be stored in clear text. We should provide a way to protect persisted conversation history while keeping the feature flexible enough to accommodate different security requirements and key management strategies.
Security audits have highlighted a security concern with the current conversation history persistence mechanism.
When local storage history is enabled, Tock stores the conversation history in clear text in the browser's
localStorage. This means that malicious browser extensions, injected scripts, or other code with access to the application's storage can potentially retrieve the full conversation history, including potentially sensitive information.The history should therefore not be stored in clear text. We should provide a way to protect persisted conversation history while keeping the feature flexible enough to accommodate different security requirements and key management strategies.