theopenconversationkit / theopenconversationkit/tock-react-kit
Encrypt conversation history stored in localStorage
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 23
- Forks
- 23
- Avg merge
- 5m
- Merged PRs (30d)
- 1
Description
Security audits have highlighted a security concern with the current conversation history persistence mechanism.
When local storage history is enabled, Tock stores the conversation history in clear text in the browser's localStorage. This means that malicious browser extensions, injected scripts, or other code with access to the application's storage can potentially retrieve the full conversation history, including potentially sensitive information.
The history should therefore not be stored in clear text. We should provide a way to protect persisted conversation history while keeping the feature flexible enough to accommodate different security requirements and key management strategies.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by locating the localStorage conversation-history persistence entry point, then review how history is serialized and what extension points exist for encryption and key management. Done means persisted history is not clear text while the feature remains configurable for different security requirements.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100