Does this protect against rogue dependencies?

[SMLaursen]

As the title states, I'm a little bit in doubt of whether this protects against rogue dependencies (i.e. a 3rd party dependency that reads from local storage and sends it elsewhere)

I mean couldn't the 3rd party dependency not just try read the SECURE_LOCAL_STORAGE_HASH_KEY and SECURE_LOCAL_STORAGE_PREFIX from .env and decrypt all of LocalStorage using these + your getFingerprint() before sending it away?