From ea082b34733e9002fe65a54b8ee44338cc859979 Mon Sep 17 00:00:00 2001 From: Lewis Carhart Date: Thu, 30 Apr 2026 00:47:52 +0100 Subject: [PATCH] fix(background-checks): remove employee PII from sessionStorage Stop storing employeeName and employeeEmail in sessionStorage during the Stripe billing redirect flow. Only requesterNotes (non-PII) is persisted. After redirect, employeeName re-derives from the employee prop and the email field resets to its default. Resolves code-scanning alert #133 (clear text storage of sensitive information). Co-Authored-By: Claude Opus 4.6 (1M context) --- .../[employeeId]/components/EmployeeBackgroundCheck.tsx | 4 ++-- .../people/[employeeId]/components/backgroundCheckForm.ts | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeBackgroundCheck.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeBackgroundCheck.tsx index 32d52eb2a7..db1160434e 100644 --- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeBackgroundCheck.tsx +++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeBackgroundCheck.tsx @@ -191,8 +191,8 @@ export function EmployeeBackgroundCheck({ } form.reset({ - employeeName: pendingRequest.employeeName, - employeeEmail: pendingRequest.employeeEmail, + employeeName: form.getValues('employeeName') || employee.user.name || '', + employeeEmail: form.getValues('employeeEmail') || '', requesterNotes: pendingRequest.requesterNotes ?? '', }); setBillingSetupComplete(true); diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckForm.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckForm.ts index bf77573e1e..6d2b543473 100644 --- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckForm.ts +++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckForm.ts @@ -8,9 +8,10 @@ export const backgroundCheckSchema = z.object({ export type BackgroundCheckFormValues = z.infer; -const pendingBackgroundCheckSchema = backgroundCheckSchema.extend({ +const pendingBackgroundCheckSchema = z.object({ memberId: z.string(), organizationId: z.string(), + requesterNotes: z.string().optional(), }); export type PendingBackgroundCheckRequest = z.infer; @@ -65,8 +66,6 @@ export function writePendingBackgroundCheckRequest({ const pendingRequest: PendingBackgroundCheckRequest = { organizationId, memberId, - employeeName: values.employeeName, - employeeEmail: values.employeeEmail, requesterNotes: values.requesterNotes, }; window.sessionStorage.setItem(