chrome.storage.sync not used for unencrypted passwords or secrets

chrome.storage.sync transmits data to Google's servers and replicates it across every browser the user is signed into. Storing an unencrypted API key, OAuth token, or password in sync storage means that credential is now held by Google and replicated to potentially untrusted devices. CWE-312 (Cleartext Storage of Sensitive Information) and CWE-313 (Cleartext Storage in a File or on Disk) both apply — the data is transmitted and stored by a third party outside the developer's control. OWASP 2021 A02 and GDPR Art. 32 require appropriate encryption for data at rest; syncing credentials in plaintext fails both standards.

Never store passwords, tokens, or API keys in chrome.storage.sync. Use chrome.storage.local with encryption for any sensitive value:

// BAD — syncs plaintext secret to Google's servers
chrome.storage.sync.set({ apiKey: 'sk-abc123' });

// GOOD — stays local, encrypted at rest
import { encrypt } from './crypto-utils.js';
const encrypted = await encrypt('sk-abc123', derivedKey);
chrome.storage.local.set({ encryptedApiKey: encrypted });

For non-sensitive preferences (theme, language, UI state), chrome.storage.sync is appropriate. Draw the line at any value that grants access to an external service or identifies the user.