What is 'web storage (localStorage/sessionStorage) security' and what data should NOT be stored there?

• A.localStorage is encrypted by the browser and is safe for storing access tokens and sensitive data
• B.localStorage uses IndexedDB encryption that prevents JavaScript access to stored values
• C.localStorage is more secure than sessionStorage because it persists across browser restarts
• D.Web storage is accessible to all JavaScript on the page - including XSS payloads. localStorage.getItem('token') is trivial to read in a single line. Session tokens, JWTs, access tokens, private keys, PII, and passwords should NOT be in localStorage. Tokens should be in HttpOnly cookies (invisible to JavaScript). localStorage is appropriate for: UI preferences, non-sensitive cache, feature flags