Audit: 13 repos keep credentials in web storage, seven are government services

A developer scanned 258,117 source files and found 189 public repositories touching web storage. Thirteen store credentials, eleven of them bearer tokens; seven of those repos belong to government digital services (Helsinki, UK ONS, US GSA, Canada, France, British Columbia). Two store a refresh token alongside the access token.

• 258,117 files scanned; 1,423 touch web storage across 189 repositories
• 13 repositories store credentials, 11 of them bearer tokens
• Seven of the thirteen are government services: Helsinki, UK ONS, US GSA, Canada, France, BC
• The no-jwt-in-storage rule hit 68% precision: 19 flags, 6 false positives