# Security Check > Security audit of current changes for iOS/Swift vulnerabilities and best practices Use when this capability is needed. - Skill: `tomevault-io/security-check-3` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-check-3` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-check-3/raw - Safety review: pending (external: skill-scanner PASS, skillspector CAUTION) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-check-3 --- # Security Check Perform a focused security audit on the current changes. Analyze the diff and the full content of changed files for security vulnerabilities, insecure patterns, and iOS-specific risks. **Scope:** $ARGUMENTS --- ## Step 1: Gather Changes Determine which changes to audit: - `--staged` → `git diff --cached` (only staged changes) - `--uncommitted` → `git diff HEAD` (only uncommitted changes) - No flag → Default to `git diff main` (all changes on the branch vs main, committed and uncommitted) Also run `git status` to identify new untracked files. Read the diff output AND the full content of every changed file. Security issues often depend on context beyond the changed lines. --- ## Step 2: Secrets & Credentials - [ ] No hardcoded API keys, tokens, passwords, or secrets - [ ] No secrets in `Info.plist`, string literals, or configuration files committed to source - [ ] No secrets logged or included in error messages - [ ] No private keys or certificates committed - [ ] `.gitignore` covers sensitive files (`.env`, `.netrc`, `*.p12`, `*.mobileprovision`) --- ## Step 3: Data Security - [ ] Sensitive data not stored in plain `UserDefaults` (use Keychain instead) - [ ] No sensitive data written to unprotected files without encryption - [ ] No sensitive data in `Codable` objects passed via `TrapezioScreen` properties (they're serializable) - [ ] SwiftData queries use parameterized predicates (no string interpolation in `#Predicate`) - [ ] No sensitive data in `TrapezioState` structs that could be logged or exposed - [ ] Keychain items use appropriate access control if applicable --- ## Step 4: Network Security - [ ] No cleartext HTTP traffic (all URLs use HTTPS) - [ ] No disabled certificate validation or custom `URLSessionDelegate` that accepts all certs - [ ] No sensitive data in URL query parameters (use request body instead) - [ ] API responses validated before use (no blind trust of server data) - [ ] No `NSAppTransportSecurity` exceptions that weaken ATS - [ ] No hardcoded URLs that should be configurable per environment --- ## Step 5: Input Validation - [ ] User input validated before passing to use cases or repositories - [ ] No predicate injection via `NSPredicate` or `#Predicate` with unsanitized user input - [ ] Format strings don't use user-controlled data - [ ] File paths not constructed from user input without sanitization - [ ] Deep link / navigation parameters validated in routing --- ## Step 6: Concurrency Security - [ ] No race conditions that could lead to auth bypass or privilege escalation - [ ] Token/session state not shared mutably across isolation boundaries without synchronization - [ ] `@unchecked Sendable` only used on interactor subclasses (not to suppress legitimate warnings) - [ ] `nonisolated(unsafe)` only used on `TrapezioStore.state` (framework pattern) - [ ] `OSAllocatedUnfairLock` usage is correct (balanced lock/unlock) - [ ] Cancellation does not leave security-sensitive operations in an incomplete state --- ## Step 7: Logging & Error Handling - [ ] No `print()` statements logging sensitive data (passwords, tokens, PII) - [ ] No `debugPrint()` or `dump()` of sensitive objects - [ ] Debug-only code guarded with `#if DEBUG` - [ ] Error messages do not leak implementation details (class names, file paths) - [ ] `StrataException.message` doesn't contain internal system details exposed to users --- ## Step 8: Dependency Security - [ ] No new external dependencies added without review - [ ] `Package.swift` uses pinned or tested version ranges - [ ] No known vulnerabilities in dependencies (currently: zero external deps) --- ## Step 9: Report ### Summary Brief assessment of the security posture of the changes. ### Security Checklist Show all completed checklists from Steps 2-8 with pass/fail/not-applicable indicators. Skip entire sections that are not applicable to the changed files. ### Vulnerabilities Found List by severity: - **Critical:** Exploitable vulnerabilities that must be fixed immediately - **High:** Significant risks that should be fixed before merge - **Medium:** Potential issues that should be addressed - **Low:** Minor concerns or hardening opportunities For each vulnerability: - File path and line reference - Description of the issue - Recommended fix ### Clean If no issues are found, state that the changes pass the security audit. --- > Source: [jkjamies/MESA-iOS](https://github.com/jkjamies/MESA-iOS) — distributed by [TomeVault](https://tomevault.io).