Fix: Add cross-tab synchronization and document plaintext localStorag…

.github/workflows/ci.yml

@@ -184,7 +184,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 11
+          version: 10
 
       - name: Install Nargo (for hasher circuit)
         run: |
@@ -220,7 +220,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 11
+          version: 10
 
       - name: Install Nargo (for hasher circuit)
         run: |
@@ -277,7 +277,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 11
+          version: 10
 
       - name: Install Stellar CLI
         run: |

SECURITY.md

@@ -5,6 +5,51 @@ pool of funds (currently testnet USDC), so security issues are taken
 seriously even at this stage — please report them responsibly rather than
 opening a public issue.
 
+## Known Limitations
+
+### Plaintext localStorage for Notes and KYC
+
+**⚠️ CRITICAL: Notes and KYC data are stored unencrypted in browser localStorage**
+
+The current implementation stores bearer-spendable notes and KYC preimages
+as plaintext JSON in your browser's localStorage. This means:
+
+- **Any XSS vulnerability** in the DShield app or a compromised dependency
+  can read your notes and spend them
+- **Malicious browser extensions** with localStorage access can steal your
+  notes
+- **Physical device access** — anyone with brief access to your device (even
+  locked but with the browser still running, depending on OS security) can
+  open DevTools and read your notes
+- **Shared/public computers** — never use DShield on a library computer,
+  internet café, or any shared device
+
+**Each note is equivalent to cash.** If someone obtains your note string,
+they can withdraw those funds to their own address. There is no way to
+revoke or recover a stolen note.
+
+**Mitigation:**
+
+- Only use DShield on a **personal, secure device** with full-disk encryption
+- Keep your browser and OS up to date
+- Be cautious about which browser extensions you install
+- For production use, export your notes (copy the note string from the UI)
+  and store them in a password manager or encrypted backup
+- Consider the **Longer-term roadmap** below for passphrase-based encryption
+
+**Longer-term roadmap:** A future version may add optional
+passphrase-derived encryption for the note store (similar to MetaMask's
+approach), where notes are encrypted with a key derived from a user
+passphrase and only decrypted in memory when needed. This would protect
+against casual device access and malicious extensions (though not against
+XSS while the wallet is unlocked). Until then, treat your device's security
+as the only protection for your notes.
+
+**Cross-tab write protection:** As of this update, concurrent writes
+from multiple tabs/windows no longer silently clobber each other — an
+advisory lock serializes updates. However, this does not address the
+plaintext storage issue.
+
 ## Scope
 
 Anything that could let someone:

frontend/.npmrc

@@ -0,0 +1,2 @@
+resolution-mode=lowest-direct
+strict-peer-dependencies=false