Summary
src/utils/security/transactionSecurity.ts stores deviceId in localStorage unencrypted.
Affected area
src/utils/security/transactionSecurity.ts line ~88
Steps to reproduce / impact
Device fingerprint is reusable to impersonate the user across browsers on the same machine and supports correlation of identity-bound security policies.
Expected behaviour
Store only a salted hash, refresh per session, never reuse across origins. Or remove entirely if not used in security decisions.
Acceptance criteria
Summary
src/utils/security/transactionSecurity.tsstores deviceId in localStorage unencrypted.Affected area
src/utils/security/transactionSecurity.tsline ~88Steps to reproduce / impact
Device fingerprint is reusable to impersonate the user across browsers on the same machine and supports correlation of identity-bound security policies.
Expected behaviour
Store only a salted hash, refresh per session, never reuse across origins. Or remove entirely if not used in security decisions.
Acceptance criteria