## iOS Security Best Practices

### Secure Data Storage

```swift
// FORBIDDEN  -  UserDefaults for sensitive data
UserDefaults.standard.set(authToken, forKey: "token")

// CORRECT  -  Keychain
let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrAccount as String: "authToken",
    kSecValueData as String: tokenData
]
SecItemAdd(query as CFDictionary, nil)
```

### Hardcoded Credentials

```swift
// FORBIDDEN
let apiKey = "sk-abc123..."

// CORRECT  -  Info.plist (gitignored) or server-side
let apiKey = Bundle.main.infoDictionary?["API_KEY"] as? String
```

### Network Security

- ATS enabled  -  no HTTP without exception justification
- Certificate pinning for sensitive endpoints
- Never log request/response bodies in production

### Privacy

- Only permissions needed for core functionality
- Purpose strings clearly explain why
- ATT before any tracking
- Sign in with Apple alongside other social logins