Current language: Apps should persist tokens and other sensitive data in app-specific storage locations only, not in system-wide-discoverable locations. Change language with upper-case conformance verbs: Apps SHOULD persist tokens and other sensitive data only in app-specific storage locations, and SHOULD NOT persist them in system-wide-discoverable locations. (Note, we aren't introducing "SHALL" level requirements here because in some app architectures (e.g., on an appropriately secured device) persisting data in a discoverable location may be appropriate.)