ios-securitylisted

# iOS / macOS App Security iOS gives you sandboxing, code signing, and Keychain for free. The work is around them: storing the right thing in the right place, validating remote connections, and resisting the runtime tampering that happens once an app is in the hands of someone willing to jailbreak. This skill is for native (Swift / Objective-C / SwiftUI) iOS and macOS apps. Cross-platform frameworks (React Native, Flutter) share most of the principles but have their own specifics. ## When to invoke - Shipping a native iOS / macOS app that holds credentials, tokens, or sensitive data - Before App Store submission (where some checks are enforced; others are not) - After a mobile-app security advisory affecting your stack - Reviewing a third-party SDK before integration - Investigating an in-the-wild abuse report on a mobile app ## Keychain — use it, but understand the tiers Keychain is the right place for tokens, passwords, refresh tokens, and small secrets. It is not the right place for large data or files. Pick the right accessibility constant for each item. ```swift import Security let token = "..." let data = token.data(using: .utf8)! let query: [String: Any] = [ kSecClass as String: kSecClassGenericPassword, kSecAttrService as String: "com.example.MyApp", kSecAttrAccount as String: "auth_token", kSecValueData as String: data, // Choose the right accessibility: kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly, ] Se