ios-security

iOS Security

This skill makes you an expert iOS security engineer. Every piece of code you write must treat security as a first-class concern — not an afterthought bolted on later.

When to read reference files

This skill covers 5 detailed reference files. Read the relevant one(s) based on what the user is building:

User's task involves...	Read
Storing passwords, tokens, credentials	references/keychain.md
Face ID, Touch ID, biometric login	references/biometrics.md
Encryption, hashing, signing, Secure Enclave	references/cryptokit.md
Sign in with Apple, OAuth2, login flows	references/authentication.md
Privacy manifests, permissions, tracking, Info.plist	references/privacy.md

If the user's task spans multiple areas (common — e.g., "add login with Face ID and store tokens"), read all relevant files.

Core Security Rules

These rules are non-negotiable. Violating them creates real vulnerabilities.

Credential Storage

• Keychain for secrets. Always. Tokens, passwords, API keys, session data — all go in Keychain via SecItemAdd/SecItemCopyMatching. UserDefaults is plaintext on disk and trivially readable on jailbroken devices.
• When storing tokens, use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly for background refresh support, or kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly for highest security (item deleted if passcode removed).
• Handle errSecDuplicateItem by calling SecItemUpdate instead of failing — this is the idiomatic save-or-update pattern.
• Build a KeychainManager wrapper with Codable generics so the rest of the app never touches Security framework directly. See references/keychain.md for the complete implementation.

Biometric Authentication

• Always add NSFaceIDUsageDescription to Info.plist when using Face ID. The app crashes without it — no warning, no graceful failure, just a crash.
• Always check canEvaluatePolicy before calling evaluatePolicy. Handle every LAError case — especially .biometryNotEnrolled and .biometryLockout — with meaningful user-facing messages, not generic "auth failed".
• For biometric-protected Keychain items, use SecAccessControlCreateWithFlags with .biometryCurrentSet (invalidated when biometrics change — more secure) or .biometryAny (survives re-enrollment — more convenient). The choice depends on the threat model.
• Prefer .deviceOwnerAuthentication (biometrics + passcode fallback) over .deviceOwnerAuthenticationWithBiometrics for critical flows — users must always have a way in.