Since it's nostr, your nsec should never leave your browser, cookies are created by servers
So the only two other locations I can think of is localstorage and indexeddb.

Try running this in your js-console

```
localStorage.clear()
```
That's all I have :'-)