Where are @SessionAttributes stored? Is it safe to store sensitive information in them?

I can't really find anything about this.

I'm using custom session attributes to pass error/success messages around a thymeleaf site.

Where are they usually stored? Is it safe to store sensitive information on it? Is it possible for the end user to change the content of what's stored in it?

I ran into some problems when I used HttpSession so I decided to come up with something else:

First a ControllerAdvice class (also handles exceptions but I left that out):

@ControllerAdvice
public class GlobalControllerAdvice {
    @ModelAttribute("aRandomName")
    public HashMap<String, String> message() {
        return new HashMap<>(3);
    }
}

And if I want to use it in a Controller, I annotate the controller with @SessionAttributes("aRandomName")

And to use it a mapping, I add @ModelAttribute("aRandomName") HashMap<String, String> message to the method parameters. Anything I add in the message HashMap will be available everywehere on the website.

This is an example of how I'm using it in thymeleaf:

<div class="w-50 alert alert-danger" th:if="${message.getOrDefault('emailNotFound', null) != null}"
             th:utext="${message.get('emailNotFound')}">
</div>
[[${message.clear()}]]