---

name: ios-security description: Secure iOS apps with secure storage, biometrics, and data protection. Use when implementing secure storage, Face ID/Touch ID, or data protection in iOS. metadata: triggers: files: - '**/*.swift' keywords: - SecItemAdd - kSecClassGenericPassword - LAContext - LocalAuthentication - ios security - swift security - biometric - face id - touch id - certificate pinning - app transport security

iOS Security

Priority: P0 (CRITICAL)

Implementation Workflow

1. Store secrets in secure storage — Use SecItemAdd, SecItemUpdate, and SecItemDelete with kSecClassGenericPassword for tokens/PII. Never use UserDefaults.
2. Add biometric auth — Use LocalAuthentication with LAContext. Verify availability with canEvaluatePolicy before prompting.
3. Encrypt files — Use Data.WritingOptions.completeFileProtection when saving to disk.
4. Keep ATS enabled — Never disable App Transport Security globally in the iOS Info configuration.
5. Pin certificates — Use ServerTrustManager or TrustKit for production apps to prevent MITM attacks.
6. Strip sensitive logs — Ensure PII and tokens removed from logs in Release builds.

See Secure storage and biometrics implementation examples

Anti-Patterns

• No Secrets in UserDefaults: Always use secure storage for tokens and PII
• No Unhandled LAError: Check for userCancel and authenticationFailed in biometric flows
• No PII/Token Logging: Strip sensitive data from all logs in Release builds

References

• Secure Storage & Biometrics Implementation

Related Topics

• common/security-standards
• architecture

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

• iOS app configuration
• LocalAuthentication