No you never want to store any sensitive data in custom state, options sets, default values for data base or even inside workflows - basically whatever is on the client is untrusted.
Server = security
Cheers.
1 Like