Disclose plaintext browser storage for Lab saved keypairs

[kalepail]

Finding

Stellar Lab documentation does not make the Saved Keypairs storage and offline
boundary prominent enough for a secret-bearing browser tool. Current Laboratory
source serializes saved keypair objects to browser localStorage as
plaintext JSON, and current tests place the S... secret in that object.
The Saved Keypairs page correctly restricts use to Testnet/Futurenet and says
never Mainnet, but it does not state the concrete storage property: the secret
is persisted as plaintext browser storage, not encrypted custody.

Evidence

Both GT-54 verification lanes reviewed the current Lab docs and source. The
pre-read-locked blind lane independently confirmed the browser-storage boundary
before reading the primary report, and the final reconciliation records
plaintext JSON in localStorage as the controlling fact. No secret was
generated, pasted, saved or transmitted during verification.

This is a docs-content gap rather than a claim that local browser storage is a
remote service. It is also separate from wallet/hardware/external-signature
flows, which avoid placing a production seed in Lab.

Additional recorded evidence:

• Lab Saved Keypairs docs inspected 2026-07-11 restrict the feature to Testnet and Futurenet and say never Mainnet
• current stellar/laboratory localStorageSavedKeypairs source serializes saved keypair objects into browser localStorage
• current Laboratory tests persist the S-secret value in the saved object
• rechecked 2026-07-14: the current page says browser local storage but does not state that it is plaintext JSON; current Laboratory source serializes saved keypairs with JSON.stringify

Recommendation

Add one warning beside the existing Saved Keypairs network restriction: an
S... secret is stored as plaintext JSON in browser localStorage, not
encrypted custody. Keep the existing Testnet/Futurenet-only and never-Mainnet
guidance.

Source Record

This was found by the downstream Raven eval/improvements loop and recorded as sd-030 (stellar-docs, discovered 2026-07-11).

Public source record: improvements/stellar-docs/sd-030-lab-saved-keypairs-offline-boundary.md

Immutable source snapshot: bbb0d4f55527

Resolution Handoff

When a fix is deployed, please link the resolving issue or PR to the source record above and notify Raven through:

https://github.com/kalepail/stellar-raven/issues/new?template=upstream-improvement-ready.yml&title=%5Bupstream-ready%5D%20sd-030%3A%20

Include the finding id, resolving issue/PR, deployed version or timestamp, and the smallest live recheck. Raven independently verifies the upstream surface before changing the finding to fixed-upstream; issue closure or a merged PR alone is not treated as proof. After a distinct reviewer repeats the live check, the active finding is retired to Raven's resolved ledger while the immutable snapshot remains available.

[kalepail]

Evidence correction: current Lab no longer writes new saves as literal plaintext JSON. It uses reversible XOR/base64 obfuscation with a public constant and explicitly warns that this is not for sensitive data. The compatibility reader still accepts plain JSON, so pre-September-2025 saves can remain plaintext until re-saved. Recommended wording: secrets are recoverable from browser localStorage; current obfuscation is not encryption, and older saves may remain plaintext.

Audit evidence: https://gist.githubusercontent.com/ElliotFriend/3b3641b929b4408a834b85bcb4e75449/raw/a90e6b453ee3505ef2525b4428eaa75752e3ae08/raven-audit-rebuttal.md

[ElliotFriend]

Confirmed — the docs fix in PR #2620 uses exactly this framing: saved keypairs are obfuscated but not encrypted, any secret key saved there should be treated as recoverable by anyone (or any script) with access to the browser, and keypairs saved before September 2025 may remain in plain text until re-saved (covering the back-compat JSON.parse read path). Nothing needed in the Laboratory repo — the Lab UI already warns inline.

[kalepail]

Raven independently rechecked sd-030 on 2026-07-27 and confirmed the original trigger is resolved live.

Live recheck: 2026-07-27 GET https://developers.stellar.org/docs/tools/lab/saved/keypairs - 'Saved keypairs are obfuscated, but not encrypted - treat any secret key saved here as recoverable by anyone (or any script) with access to your browser', alongside the pre-September-2025 plain-text caveat and the Testnet/Futurenet-only guidance

Thanks for the fix and for the deployment handoff. The active finding is being retired under the ephemeral improvements lifecycle. Immutable source snapshot: https://github.com/kalepail/stellar-raven/blob/773857262d462506947a324b7437b8499f886287/improvements/stellar-docs/sd-030-lab-saved-keypairs-offline-boundary.md