# IOS Sec

> Security policy for iOS apps. Enforces OWASP Top 10, Mobile Top 10, and CWE Top 25 mitigations.

- Skill: `majiayu000/ios-sec` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/ios-sec`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/ios-sec/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/ios-sec

---


## Purpose

Ensure iOS code is secure by default. For security output format and core refusal policy, see `/shared-sec-baseline`.

## iOS-specific security concerns (always check)

1. **Keychain for secrets** — never UserDefaults for tokens, passwords, or API keys
2. **ATS enforcement** — no exceptions without justification; never disable TLS validation
3. **Deep link validation** — validate scheme, host, and parameters before acting on universal/custom links
4. **Notification payloads** — treat as untrusted input; validate before navigation or data use
5. **Biometric auth** — use LocalAuthentication with fallback policy; don't rely solely on device passcode
6. **Privacy manifest** — declare data collection accurately; required APIs need justification

## Standard security (brief check)

- Input validation: sanitize all external input (network, clipboard, deep links)
- Error handling: no internal details surfaced to UI or logs
- Logging: no PII, tokens, or credentials; use OSLog with appropriate privacy levels
- Network: certificate pinning for sensitive endpoints; handle certificate failures safely

## Additional refusals (iOS-specific)

Also refuse requests that: disable ATS, or store secrets in UserDefaults. Explain why and propose secure alternative.

## Reference

For detailed OWASP/Mobile Top 10/CWE mitigation patterns, see `reference/ios-sec-reference.md`