ios-security

name	ios-security
description	Secure iOS apps with secure storage, biometrics, and data protection. Use when implementing secure storage, Face ID/Touch ID, or data protection in iOS.
metadata	{"triggers":{"files":["**/*.swift"],"keywords":["SecItemAdd","kSecClassGenericPassword","LAContext","LocalAuthentication","ios security","swift security","biometric","face id","touch id","certificate pinning","app transport security"]}}

iOS Security

Priority: P0 (CRITICAL)

Implementation Workflow

1. Store secrets in secure storage — Use SecItemAdd, SecItemUpdate, and SecItemDelete with kSecClassGenericPassword for tokens/PII. Never use UserDefaults.
2. Add biometric auth — Use LocalAuthentication with LAContext. Verify availability with canEvaluatePolicy before prompting.
3. Encrypt files — Use Data.WritingOptions.completeFileProtection when saving to disk.
4. Keep ATS enabled — Never disable App Transport Security globally in the iOS Info configuration.
5. Pin certificates — Use ServerTrustManager or TrustKit for production apps to prevent MITM attacks.
6. Strip sensitive logs — Ensure PII and tokens removed from logs in Release builds.

See Secure storage and biometrics implementation examples

Anti-Patterns

• No Secrets in UserDefaults: Always use secure storage for tokens and PII
• No Unhandled LAError: Check for userCancel and authenticationFailed in biometric flows
• No PII/Token Logging: Strip sensitive data from all logs in Release builds

References

• Secure Storage & Biometrics Implementation

Related Topics

• common/security-standards
• architecture

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

• Info.plist,info
• LocalAuthentication