Security audit
Security checks for vulnerabilities and agentic risk
This skill provides scoped mobile-app security reviews, with no evidence of hidden credential collection, automatic changes, or background activity.
Limit the audit to authorized app repositories and keep discovered secrets redacted. Review suggested fixes before applying them. The scanner's unresolved references mostly name target-app files and example paths; all four bundled references were inspected. Static review still leaves runtime behavior to verify.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// BAD
UserDefaults.standard.set(token, forKey: "refreshToken")
// GOOD: Keychain, not migrated to other devices or backups
let query: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrService as String: "com.example.auth",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// GOOD const storage = FlutterSecureStorage( iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock_this_device), ); await storage.write(key: 'refresh_token', value: token);
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
showVault()
}
// GOOD: Keychain item protected by access control; the OS releases it only after biometry
let access = SecAccessControlCreateWithFlags(
nil, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly, .biometryCurrentSet, nil)
// add with kSecAttrAccessControl: access; read with kSecUseAuthenticationContext off the main thread
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- [ ] Cleartext disabled; no trust-all managers, hostname verifiers or `badCertificateCallback`
- [ ] MQTT and other IoT channels use TLS; BLE commands authenticated, not only CRC-checked
- [ ] Pinning, if present, has backup pins, expiry and a rotation plan
- [ ] Biometric auth bound to a `CryptoObject` or Keychain access control
- [ ] OAuth via system browser with PKCE; authorization enforced server-side
- [ ] Every exported component, deep link and App / Universal Link validated
- [ ] WebView bridges origin-scoped; file access off; untrusted URLs not loaded
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const storage = FlutterSecureStorage(
iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock_this_device),
);
await storage.write(key: 'refresh_token', value: token);
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `ThisDeviceOnly` items are not restored onto a different device from a backup.
- Keychain items can survive app deletion. Clear stale credentials on first launch after install
(detect with a flag in `UserDefaults`, which is removed on uninstall).
- Shared access across your apps uses a Keychain access group entitlement; keep it as narrow as possible.
## Biometric-bound Keychain item
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
kSecValueData as String: secret,
]
let status = SecItemAdd(query as CFDictionary, nil)
guard status == errSecSuccess else { throw KeychainError(status: status) }
}
// Blocks while the system prompt is shown: never call on the main thread.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
] var result: CFTypeRef? let status = SecItemCopyMatching(query as CFDictionary, &result) guard status == errSecSuccess, let data = result as? Data else { throw KeychainError(status: status) } return data }
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
ASWebAuthenticationSession) with PKCE, not an
embedded WebView. Passkeys via Credential Manager or AuthenticationServices where supported.isAdmin flag is not access control.Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
[MASVS controls and Top 10 map](references/masvs-map.md).
For CRA, RED delegated act / EN 18031 or GDPR questions, hand the findings to `mobile-eu-compliance`.
- Android: merged release manifest, network security config, backup rules, release build type, catalogs.
- iOS: `Info.plist`, entitlements, `PrivacyInfo.xcprivacy`, `.xcconfig`, lock files. Flutter: both of these.
3. Run the quick-scan patterns from the references. Each hit is a candidate, not a finding.
4. Walk the MASVS categories in order: STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY.
Read the full code path for every candidate, not just the matching line.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Everything in an APK, IPA or Flutter bundle is readable: BuildConfig, strings.xml, Info.plist,
.xcconfig, assets, --dart-define values. Obfuscation does not change that.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
```swift
// BAD: Info.plist and xcconfig values ship in plain text
let key = Bundle.main.object(forInfoDictionaryKey: "BROKER_PASSWORD") as? String
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- `BIOMETRIC_STRONG` for crypto-bound auth. `setInvalidatedByBiometricEnrollment(true)` and `.biometryCurrentSet`
invalidate the key on new enrollment. iOS requires `NSFaceIDUsageDescription` in `Info.plist`.
### 7. Sessions are controlled by the server (MASVS-AUTH-1, M3)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Checklist
- [ ] Threat model and data classification written down before findings
- [ ] Release manifest, `Info.plist`, entitlements, network config and build types reviewed
- [ ] No privileged secrets in code, resources, `BuildConfig`, `Info.plist`, `--dart-define` or git history
- [ ] Tokens and keys in Keystore / Keychain-backed storage; no new `security-crypto` usage
- [ ] Keychain accessibility class and Android backup rules checked
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- [ ] Threat model and data classification written down before findings
- [ ] Release manifest, `Info.plist`, entitlements, network config and build types reviewed
- [ ] No privileged secrets in code, resources, `BuildConfig`, `Info.plist`, `--dart-define` or git history
- [ ] Tokens and keys in Keystore / Keychain-backed storage; no new `security-crypto` usage
- [ ] Keychain accessibility class and Android backup rules checked
- [ ] No secrets or personal data in release logs; `FLAG_SECURE` or snapshot cover on sensitive screens
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# iOS security reference
Load this for Swift, Objective-C, `Info.plist`, `.entitlements`, `.xcconfig` and `PrivacyInfo.xcprivacy`.
Call out every `Info.plist` and entitlement change explicitly in the report; they affect App Review,
signing and provisioning.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# iOS security reference
Load this for Swift, Objective-C, `Info.plist`, `.entitlements`, `.xcconfig` and `PrivacyInfo.xcprivacy`.
Call out every `Info.plist` and entitlement change explicitly in the report; they affect App Review,
signing and provisioning.
## Quick scan
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| Pattern | Why | Usual severity |
|---|---|---|
| Keys like `API_SECRET`, `PASSWORD`, `TOKEN` in `Info.plist` or `.xcconfig` | Secret in the IPA | Critical if privileged |
| `NSAllowsArbitraryLoads` = YES | ATS disabled globally | High, needs App Review justification |
| `NSExceptionAllowsInsecureHTTPLoads`, `NSExceptionMinimumTLSVersion` lowered | Cleartext or weak TLS for a domain | High |
| `.useCredential` with `serverTrust` and no `SecTrustEvaluateWithError` | Trust-all | Critical |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| `NSAllowsArbitraryLoads` = YES | ATS disabled globally | High, needs App Review justification |
| `NSExceptionAllowsInsecureHTTPLoads`, `NSExceptionMinimumTLSVersion` lowered | Cleartext or weak TLS for a domain | High |
| `.useCredential` with `serverTrust` and no `SecTrustEvaluateWithError` | Trust-all | Critical |
| `UserDefaults` / `@AppStorage` with token, password, PIN | Plaintext plist | Medium |
| `kSecAttrAccessibleAlways` / `kSecAttrAccessibleAlwaysThisDeviceOnly` | Deprecated, readable while locked | Medium |
| `evaluatePolicy(` result used as the only gate | Hookable boolean | High for secrets or payments |
| `print(`, `NSLog(`, `privacy: .public` with personal data | Leak via device logs | Medium |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- `.userPresence` allows passcode fallback; choose deliberately and document it.
- For signing use cases, create a Secure Enclave key (`kSecAttrTokenIDSecureEnclave`) with the same access
control and have the server verify signatures.
- `NSFaceIDUsageDescription` is required in `Info.plist` when Face ID is used.
## Files and data protection
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
<!-- Info.plist: ATS on by default; pin only domains you control -->
<key>NSAppTransportSecurity</key>
<dict>
<key>NSPinnedDomains</key>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Custom trust evaluation must call `SecTrustEvaluateWithError` and only then compare pins.
- Apple platforms require Certificate Transparency for publicly trusted TLS certificates, so standard
validation already rejects many mis-issued certificates.
- ATS exceptions in `Info.plist` need a justification at App Review; local-network IoT devices are a valid
case only for the specific local domain or `NSAllowsLocalNetworking`, never a global exception.
- Local network access to IoT devices needs `NSLocalNetworkUsageDescription`.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
| `tcp://` broker URI, port `1883` | Cleartext MQTT | Critical |
| `EncryptedSharedPreferences`, `EncryptedFile`, `MasterKey` | Deprecated library | Low (migrate), not a vulnerability by itself |
| `getSharedPreferences(` / DataStore keys named token, password, pin | Plaintext secrets | Medium |
| `MODE_WORLD_READABLE`, `MODE_WORLD_WRITEABLE` | Other apps read the file | High (throws on modern targets) |
| `getExternalStorageDirectory`, `getExternalFilesDir` with sensitive data | Shared or removable storage | Medium |
| `android:exported="true"` | Entry point for other apps | Review each |
| `android:allowBackup="true"` without `dataExtractionRules` | Tokens restorable to another device | Medium |