From 2758ce8e6fd2969a83bb0e5bae4aaacb69a83b3d Mon Sep 17 00:00:00 2001
From: Sarthak <sarthakaneja260@gmail.com>
Date: Mon, 23 Mar 2026 17:02:47 +0530
Subject: [PATCH] fix: prevent sensitive data leakage from .storage during
 build

---
 src/modules/bundler.js | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/modules/bundler.js b/src/modules/bundler.js
index 3e06a989..371f323b 100644
--- a/src/modules/bundler.js
+++ b/src/modules/bundler.js
@@ -10,6 +10,7 @@ const utils = require('../utils');
 const {patchWindowsExecutable} = require('./exepatch');
 const path = require('path');
 const {inject} = require('postject');
+const SENSITIVE_STORAGE_ITEMS = ['auth_info.json', 'tokens.json', '.env'];
 
 async function createAsarFile() {
     utils.log(`Generating ${constants.files.resourceFile}...`);
@@ -185,9 +186,19 @@ module.exports.bundleApp = async (options = {}) => {
         }
 
         if (options.copyStorage) {
+            utils.warn('Copying .storage directory. Please ensure that it does not contain any sensitive data.');
             utils.log('Copying storage data...');
             try {
-                fse.copySync('.storage', `${buildDir}/${binaryName}/.storage`);
+                fse.copySync('.storage', `${buildDir}/${binaryName}/.storage`, {
+                    filter: (src) => {
+                        const filename = path.basename(src);
+                        if (SENSITIVE_STORAGE_ITEMS.includes(filename)) {
+                            utils.warn(`Skipping sensitive file: ${filename}`);
+                            return false;
+                        }
+                        return true;
+                    }
+                });
             }
             catch (err) {
                 utils.error('Unable to copy storage data from the .storage directory. Please check if the directory exists');