Sensitive Data in NSUserDefaults

Detects storage of sensitive information in NSUserDefaults which is unencrypted and accessible in device backups.

zakirkun Updated

File contents

Sensitive Data in NSUserDefaults

Overview

NSUserDefaults stores data in a plaintext plist file in the app's Library directory. This data:

  • Is included in unencrypted iTunes/iCloud backups
  • Is accessible on jailbroken devices
  • May be logged by system diagnostics

Sensitive data such as auth tokens, passwords, or PII must never be stored in NSUserDefaults.

Remediation

  • Use iOS Keychain for credentials and tokens
  • Use encrypted Core Data or Realm for sensitive structured data
  • Mark sensitive files with NSURLIsExcludedFromBackupKey if they must be in the app sandbox

zakirkun/ice-tea/tree/main/skills/mobile/ios/insecure-nsuserdefaults commit f2a8e7b209

Frequently asked questions

npx skillmds@latest add zakirkun/sensitive-data-in-nsuserdefaults