Sensitive Data in NSUserDefaults

Detects storage of sensitive information in NSUserDefaults which is unencrypted and accessible in device backups.

zakirkun f2a8e7b 2 files · 1.7 KB Updated

File contents

Sensitive Data in NSUserDefaults

Overview

NSUserDefaults stores data in a plaintext plist file in the app's Library directory. This data:

  • Is included in unencrypted iTunes/iCloud backups
  • Is accessible on jailbroken devices
  • May be logged by system diagnostics

Sensitive data such as auth tokens, passwords, or PII must never be stored in NSUserDefaults.

Remediation

  • Use iOS Keychain for credentials and tokens
  • Use encrypted Core Data or Realm for sensitive structured data
  • Mark sensitive files with NSURLIsExcludedFromBackupKey if they must be in the app sandbox

zakirkun/ice-tea/tree/main/skills/mobile/ios/insecure-nsuserdefaults commit f2a8e7b209

Frequently asked questions

npx skillmds@latest add zakirkun/sensitive-data-in-nsuserdefaults