| name | inspect-browser-storage |
| category | web |
| description | Inspect cookies, local storage, session storage, IndexedDB, caches, and service-worker state for purpose and risk. Use when client data persists unexpectedly or crosses an unsafe boundary. |
inspect-browser-storage
Map what the browser retains, who can read it, when it expires, and how it is cleared.
Procedure
- Define the origin, user state, journey, environment, and question.
- Inventory cookies, web storage, IndexedDB, Cache Storage, service workers, and downloaded files.
- Record key purpose, value class, owner, scope, lifetime, size, and readers.
- Check authentication, tenant, logout, consent, private mode, and account-switch transitions.
- Inspect script access, cookie flags, origin boundaries, encryption claims, and offline behavior.
- Identify secrets, personal data, stale schemas, orphaned caches, and unbounded growth.
- Clear or migrate one store safely and test recovery.
- Save a redacted browser-storage report with lifecycle evidence.
Guardrails
- Never paste live tokens or personal values into a report.
- Browser storage is not a trusted authorization boundary.
- Do not clear user data without understanding offline and recovery effects.
Done
- A redacted storage inventory records purpose, scope, access, and lifetime
- Logout, account switch, expiry, and clearing behavior are tested
- Stored state reconciles with the visible application state
