ios-security

iOS / macOS App Security

iOS gives you sandboxing, code signing, and Keychain for free. The work is around them: storing the right thing in the right place, validating remote connections, and resisting the runtime tampering that happens once an app is in the hands of someone willing to jailbreak.

This skill is for native (Swift / Objective-C / SwiftUI) iOS and macOS apps. Cross-platform frameworks (React Native, Flutter) share most of the principles but have their own specifics.

When to invoke

• Shipping a native iOS / macOS app that holds credentials, tokens, or sensitive data
• Before App Store submission (where some checks are enforced; others are not)
• After a mobile-app security advisory affecting your stack
• Reviewing a third-party SDK before integration
• Investigating an in-the-wild abuse report on a mobile app

Keychain — use it, but understand the tiers

Keychain is the right place for tokens, passwords, refresh tokens, and small secrets. It is not the right place for large data or files. Pick the right accessibility constant for each item.

import Security

let token = "..."
let data = token.data(using: .utf8)!

let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrService as String: "com.example.MyApp",
    kSecAttrAccount as String: "auth_token",
    kSecValueData as String: data,
    // Choose the right accessibility:
    kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
]

SecItemDelete(query as CFDictionary)
let status = SecItemAdd(query as CFDictionary, nil)

Accessibility constants — pick the strictest that works for your flow: