Security review follows data through storage, transport and diagnostics. A secret kept out of source can still leak through logs, screenshots or an overly broad tool connection.

Sensitive input → Storage boundary → Network boundary → Redacted diagnostics
  1. 1Sensitive input
  2. 2Storage boundary
  3. 3Network boundary
  4. 4Redacted diagnostics

Work through the example

Use synthetic credentials when testing failures. Check what leaves the device and who can read stored values.

Start with a disposable branch and synthetic data. Write the expected outcome before changing the implementation, then keep the first failing result. This prevents a later repair from quietly redefining the task. The procedure below is grounded in the repository reference; its examples must still be checked against your project and installed toolchain.

Implementation reference

The following focused section is adapted from the maintained project guide. It preserves the source’s examples and limitations.

Keychain for Sensitive Data

  • [ ] Store authentication tokens in Keychain, never in UserDefaults or files
  • [ ] Store API keys and secrets in Keychain (or better, fetch from server at runtime)
  • [ ] Set appropriate Keychain accessibility level for each item
  • [ ] Use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly for tokens needed in background
  • [ ] Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly for highly sensitive data
  • [ ] Never use kSecAttrAccessibleAlways (deprecated and insecure)
  • [ ] Set kSecAttrAccessControl with biometric requirement for high-value secrets
  • [ ] Delete Keychain items on user logout
import Security

enum KeychainHelper {

    static func save(
        key: String,
        data: Data,
        accessibility: CFString = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
    ) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: accessibility
        ]

        // Delete any existing item first
        SecItemDelete(query as CFDictionary)

        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw KeychainError.saveFailed(status: status)
        }
    }

    static func load(key: String) throws -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)

        switch status {
        case errSecSuccess:
            return result as? Data
        case errSecItemNotFound:
            return nil
        default:
            throw KeychainError.loadFailed(status: status)
        }
    }

    static func delete(key: String) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key
        ]
        SecItemDelete(query as CFDictionary)
    }
}

enum KeychainError: Error {
    case saveFailed(status: OSStatus)
    case loadFailed(status: OSStatus)
}

Acceptance and failure review

Checkpoint What to inspect If it does not match
Sensitive input Confirm the input and environment Preserve the failure and return to this step
Storage boundary Inspect the intermediate artifact Preserve the failure and return to this step
Network boundary Run the focused check Preserve the failure and return to this step
Redacted diagnostics Record the observed result Preserve the failure and return to this step

Ask the agent to explain the smallest change that resolves the observed mismatch. Keep unrelated refactors out of the repair. A change that makes a warning disappear is not enough if the behavior or ownership contract has changed. Re-run the same acceptance check so the before and after results are comparable.

Evidence and limits

This checklist is not a penetration test or a guarantee of security.

This is an educational guide. Its presence in the series does not certify a completed client-specific lab. The series evidence record separates executed checks from exercises and blocked environments.

Inspect the source used in this lesson.

What to do next

Next: Static review vs the compiler: what heuristics catch and what they miss