# Auto Logout Security Review

## Token exposure window

Auto-logout introduces bounded idle session windows with configurable defaults.

## Local storage safeguards

Work-draft payload is encoded and expires after 24h. Corrupted payloads are removed automatically.

## Multi-tab vectors

All tabs subscribe to same-origin sync messages. Logout events fan out across active tabs.

## Timing side channels

Only coarse inactivity timestamps are processed client-side; no activity content is logged.

## Session invalidation

Logout path delegates to existing Clerk sign-out flow and token cleanup APIs.

## Privacy notes

Activity timestamps remain client-side in this release.