Your wallet’s security is tied to your Gmail account.

If someone hacks your Gmail, they could trigger zkLogin again and gain access to your wallet (especially if 2FA is off). So while zkLogin is trust-minimized and non-custodial, the weakest link is you forgetting to secure your Google account.

Enable 2FA on Gmail (preferably with an authenticator app, not just SMS). Regularly review your Google account’s login activity and app access. Don’t reuse passwords or leave devices unlocked.

Stashed uses Zklogin, which doesn't require a seed phrase. You'll create your wallet with your email and from there, you'll be able to manage your funds. It's a safe method, but if your email gets compromised, they could potentially access your funds. However, to ensure security, keep your Gmail account secure to prevent unauthorized access. Currently, there isn't an official chart site for Sui tokens like TapTools for Cardano.