Switching must not leave the previous account's sensitive state

What it is

When switching from account A to B, A’s unsent draft, an ID number on the clipboard, a WebView session, a payment form in memory—if those remain, B’s user (or the same person’s other identity) can see them or send them. Not keeping the previous account’s sensitive state means that when the switch completes, those A-authored transients are dropped or filed in storage only A can reopen, and B’s UI starts from B’s own state. This is not local sign-out: A’s session may still hang in the switcher. It is not a product-wide isolation policy statement; it is on-the-spot cleanup of the switch act.

Why it happens

For speed, apps make drafts and WebViews global singletons. If a switch only changes “current user id,” the singleton still holds A’s words. The send button does not check author, so B’s name sends A’s draft. The OS clipboard is hard to clear, but in-app pasteboards, OTP countdowns, and the file picker’s Recents belong to the app and must be bucketed per account or cleared on switch. Cold-start restore that restores “last screen” without “last who” hands A’s half-filled payment sheet to B. Cleanup failure often looks like a small glitch; the consequence is crossed identity.

Studying it

Leave unsent content in A, open a logged-in WebView, copy a sensitive field, switch to B, and see whether B can see or send it.

Independent variables: drafts global versus per-account, whether switch destroys the WebView, whether Recents are per-account. Dependent variables: whether B sees A’s draft body, whether B’s WebView is still signed in as A, times A’s content is sent as B.

Automation belongs in regression. Human tasks: “send a new message as B” and watch for A’s words. A top-bar avatar changing to B is not successful cleanup.

Where it stops holding

An explicit “bring the draft to the new account” is a merge and must be optional; the default remains buckets. The system clipboard may still hold A’s text; the product at least must not auto-paste into B’s fields. On a shared device, switching is less clean than sign-out; if A remains a background session after switching to B, that is a product choice, but the foreground must not show A’s content. Read-only public cache (stickers) need not clear.

Applying it

• Bucket drafts, unsubmitted forms, session WebViews, and in-app Recents per account; on switch, unload A’s foreground state and load B empty or B’s own drafts.
• The send path checks that author id equals the current account; mismatch is blocked.
• After the switch animation, not even one frame of A’s content may flash.
• Verify: A writes an unsent DM and opens a logged-in page; after switching to B, B’s editor is empty, the WebView is B or signed out, and sending as B cannot carry A’s words. Regression must cover cold-start restore order.

Related

• Within the group: H6.13.1 Account switching must show which identity is current · H6.13.3 Notifications must name the source account · H6.13.4 Isolation boundaries between coexisting accounts must be explicit
• Adjacent: H6.07 Sign out · H6.06 Multi-device sessions
• Search terms: account switch leakage · draft isolation · multi-account state