No PII in browser storage (localStorage/sessionStorage); encrypted if needed

GDPR Art. 32 requires appropriate security measures for personal data, and storing PII in localStorage is a direct failure of that obligation: any JavaScript running on the page — including third-party analytics, ad scripts, or injected malicious code — can read localStorage in full. OWASP A02 (Cryptographic Failures) explicitly calls out sensitive data exposure via client-side storage as a top vulnerability. CWE-522 covers insufficiently protected credentials, which includes JWTs containing PII stored where XSS attacks can exfiltrate them. ISO-27001:2022 A.8.24 requires cryptographic protection of data at rest — but localStorage provides no encryption at all. If a user's email, name, or session token is in localStorage, a single XSS payload harvests it silently.

Move authentication tokens from localStorage to HttpOnly cookies set server-side. HttpOnly cookies are inaccessible to JavaScript by specification, eliminating the XSS exfiltration vector.

// app/api/auth/login/route.ts (Next.js)
import { cookies } from 'next/headers'

export async function POST(req: Request) {
  const { email, password } = await req.json()
  const token = await authenticateUser(email, password)

  cookies().set('session', token, {
    httpOnly: true,   // inaccessible to JavaScript
    secure: true,     // HTTPS only
    sameSite: 'lax',  // CSRF protection
    maxAge: 60 * 60 * 24 * 7,
    path: '/',
  })

  return Response.json({ ok: true })
}

Audit all localStorage.setItem calls in the codebase. For each one, verify no PII (email, phone, full name, address) is stored. User preferences (theme, language) are safe to store in localStorage — contact information is not.