Sensitive authentication tokens must not remain in the browser URL after they are consumed. Tokens in query parameters (?token=) will leak via browser history, server access logs, and Referer headers when users navigate away; removing URL fragments alone is insufficient if ?token= is supported.

Apply this standard by:

• Deleting any token-bearing query params immediately after reading/consuming them.
• Relying on safer storage (e.g., sessionStorage) or internal state for refresh/reload behavior.
• Ensuring the cleanup covers the actual supported token path(s) (query params, not only #fragment).

Example pattern:

function replaceStandaloneSessionUrl(url: URL) {
  // ... logic that extracts token from url.searchParams

  // After token is consumed, remove it from the address bar
  if (!import.meta.env.DEV) {
    url.searchParams.delete('token');
    url.searchParams.delete('daemon');
  }

  // ... continue with navigation/state update
}