What is 'web storage (localStorage/sessionStorage) security' and what data should NOT be stored there?

• A.localStorage uses IndexedDB encryption that prevents JavaScript access to stored values; a CSP nonce is validated by the server on the next request, making nonce reuse across responses harmless; browser extensions run inside the page's origin with no elevated permissions, making them safe from a security standpoint; Trusted Types stop DOM XSS by encrypting sink inputs, which the browser decrypts only for whitelisted scripts; localStorage is partitioned per tab, and two tabs on the same origin cannot see each other's keys
• B.Web storage is accessible to all JavaScript on the page - including XSS payloads. localStorage.getItem('token') is trivial to read in a single line. Session tokens, JWTs, access tokens, private keys, PII, and passwords should NOT be in localStorage. Tokens should be in HttpOnly cookies (invisible to JavaScript). localStorage is appropriate for: UI preferences, non-sensitive cache, feature flags
• C.