Common iOS security anti-patterns to avoid: - Storing tokens, passwords, or PII in `UserDefaults` instead of Keychain (`SecItemAdd` / `SecItemUpdate`). - Skipping biometric prechecks and error handling, such as not calling `canEvaluatePolicy` first or ignoring `LAError` cases like `userCancel` and `authenticationFailed`. - Writing sensitive files without iOS data protection, instead of using options like `.completeFileProtection`. - Disabling App Transport Security broadly to make networking ...
Installs into .claude/skills of the current project.
Are you the author of Ios Security?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-ios-security-01e0777e)
Common iOS security anti-patterns to avoid:
- Storing tokens, passwords, or PII in `UserDefaults` instead of Keychain (`SecItemAdd` / `SecItemUpdate`).
- Skipping biometric prechecks and error handling, such as not calling `canEvaluatePolicy` first or ignoring `LAError` cases like `userCancel` and `authenticationFailed`.
- Writing sensitive files without iOS data protection, instead of using options like `.completeFileProtection`.
- Disabling App Transport Security broadly to make networking “easier,” which weakens transport security.
- Shipping without certificate pinning for high-trust production traffic where MITM resistance matters.
- Logging tokens, PII, session IDs, or auth flow details in production logs.
- Treating biometrics as secret storage by themselves; biometrics should gate access, while secrets still belong in secure storage.
- Leaving fallback and release behavior inconsistent, for example protecting debug paths but exposing sensitive data in release logging or disk writes.
In short: keep secrets in Keychain, validate and handle biometric flows correctly, protect files at rest, keep ATS on, avoid leaking data in logs, and harden network trust where appropriate.
