app-security

App Security

Store secrets, authenticate users, and protect data correctly on Apple platforms. The golden rule: never put secrets, tokens, or keys in UserDefaults, @AppStorage, plist, or source — those are plaintext and back up off-device.

---

Keychain — the only place for secrets

Use a thin wrapper around the C API (or a vetted micro-library). Store tokens, refresh tokens, encryption keys.

import Security

enum Keychain {
    static func set(_ data: Data, account: String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: account,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
        ]
        SecItemDelete(query as CFDictionary)               // replace existing
        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else { throw KeychainError(status) }
    }
    static func get(account: String) -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: account,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        var out: CFTypeRef?
        return SecItemCopyMatching(query as CFDictionary, &out) == errSecSuccess ? out as? Data : nil
    }
}

• Choose accessibility deliberately: ...WhenUnlockedThisDeviceOnly (most secrets) or ...AfterFirstUnlockThisDeviceOnly (needed in the background). The ThisDeviceOnly variants don't migrate to new devices/backups — correct for tokens.
• Gate the most sensitive items with SecAccessControl (.biometryCurrentSet, .userPresence) so reading requires Face ID/Touch ID.

---

Sign in with Apple

Required if you offer other third-party social logins (App Review guideline 4.8). Privacy-friendly: email relay, minimal data.