Sensitive Data in NSUserDefaults
Overview
NSUserDefaults stores data in a plaintext plist file in the app's Library directory. This data:
- Is included in unencrypted iTunes/iCloud backups
- Is accessible on jailbroken devices
- May be logged by system diagnostics
Sensitive data such as auth tokens, passwords, or PII must never be stored in NSUserDefaults.
Remediation
- Use iOS Keychain for credentials and tokens
- Use encrypted Core Data or Realm for sensitive structured data
- Mark sensitive files with
NSURLIsExcludedFromBackupKeyif they must be in the app sandbox