diff --git a/src/store/reducer.test.ts b/src/store/reducer.test.ts
index e13cda9..93850dc 100644
--- a/src/store/reducer.test.ts
+++ b/src/store/reducer.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import { wizardReducer } from './reducer';
 import { INITIAL_STATE, WizardState } from './types';
 
@@ -61,4 +61,17 @@ describe('wizardReducer', () => {
     wizardReducer(INITIAL_STATE, { type: 'SET_STEP', payload: 5 });
     expect(INITIAL_STATE.currentStep).toBe(before.currentStep);
   });
+
+  it('SECU-03: never writes to localStorage or sessionStorage', () => {
+    const setItemSpy = vi.spyOn(Storage.prototype, 'setItem');
+    // Dispatch every action type to cover all reducer branches
+    wizardReducer(INITIAL_STATE, { type: 'SET_STEP', payload: 1 });
+    wizardReducer(INITIAL_STATE, { type: 'SET_BACKEND_TYPE', payload: 'azureblob' });
+    wizardReducer(INITIAL_STATE, { type: 'SET_REMOTE_NAME', payload: 'test' });
+    wizardReducer(INITIAL_STATE, { type: 'SET_REMOTE_PARAMS', payload: { key: 'val' } });
+    wizardReducer(INITIAL_STATE, { type: 'SET_DEPLOYMENT', payload: { includeInstall: true } });
+    wizardReducer(INITIAL_STATE, { type: 'RESET' });
+    expect(setItemSpy).not.toHaveBeenCalled();
+    setItemSpy.mockRestore();
+  });
 });