ios-security-review

iOS Security Review Skill

This skill ensures all iOS code follows security best practices and identifies potential vulnerabilities.

When to Activate

• Implementing authentication or authorization
• Handling sensitive user data
• Working with Keychain or Data Protection
• Creating network requests
• Implementing biometric authentication
• Storing or transmitting sensitive data
• Integrating third-party SDKs
• Handling payments or financial data

Security Checklist

1. Keychain for Sensitive Data

❌ NEVER Do This

// Storing secrets in UserDefaults
UserDefaults.standard.set(accessToken, forKey: "accessToken")
UserDefaults.standard.set(password, forKey: "password")

// Storing in plain text files
try password.write(to: fileURL, atomically: true, encoding: .utf8)

✅ ALWAYS Do This

import Security

enum KeychainError: Error {
    case duplicateEntry
    case unknown(OSStatus)
    case itemNotFound
}

final class KeychainManager {
    static let shared = KeychainManager()
    private init() {}

    func save(_ data: Data, service: String, account: String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
        ]

        let status = SecItemAdd(query as CFDictionary, nil)

        if status == errSecDuplicateItem {
            try update(data, service: service, account: account)
        } else if status != errSecSuccess {
            throw KeychainError.unknown(status)
        }
    }

    func read(service: String, account: String) throws -> Data {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecReturnData as String: true
        ]

        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)

        guard status == errSecSuccess, let data = result as? Data else {
            throw KeychainError.itemNotFound
        }

        return data
    }

    func delete(service: String, account: String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account
        ]

        let status = SecItemDelete(query as CFDictionary)

        guard status == errSecSuccess || status == errSecItemNotFound else {
            throw KeychainError.unknown(status)
        }
    }

    private func update(_ data: Data, service: String, account: String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account
        ]

        let attributes: [String: Any] = [
            kSecValueData as String: data
        ]

        let status = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)

        guard status == errSecSuccess else {
            throw KeychainError.unknown(status)
        }
    }
}

// Usage
try KeychainManager.shared.save(
    token.data(using: .utf8)!,
    service: "com.app.auth",
    account: "accessToken"
)