Auto Logout Security Review

Token exposure window

Auto-logout introduces bounded idle session windows with configurable defaults.

Local storage safeguards

Work-draft payload is encoded and expires after 24h. Corrupted payloads are removed automatically.

Multi-tab vectors

All tabs subscribe to same-origin sync messages. Logout events fan out across active tabs.

Timing side channels

Only coarse inactivity timestamps are processed client-side; no activity content is logged.

Session invalidation

Logout path delegates to existing Clerk sign-out flow and token cleanup APIs.

Privacy notes

Activity timestamps remain client-side in this release.