Code Security · Obfuscation · Crypto (iOS)

Executive summary

Strong baseline: CostcoServerTrustManager certificate pinning, AES-GCM via Keychain, NokNok PasskeyManagerKit (FIDO2), SecRandomCopyBytes for OIDC nonces, ThreatMetrix device intelligence. Notable gaps: NSAllowsArbitraryLoads = true in Notification Service Extension Info.plist (production AND QA), Privacy Manifest absent (Apple gates submissions on this since 2024), no jailbreak detection, no anti-debugging, no privacy overlay on backgrounding, and 30+ print() sites that may leak PII.

1. Code obfuscation — Swift symbol management

iOS doesn't have a direct ProGuard/R8 equivalent. The closest analogs are: stripping debug symbols from the shipped binary, uploading dSYMs to Crashlytics for symbolication while not shipping them in the IPA, and the SWIFT_OPTIMIZATION_LEVEL setting which produces less-readable disassembly.

What "obfuscation" actually means on iOS

Stripping symbols makes reverse engineering harder by removing function/method names from the binary. It does not rename or restructure — Hopper / IDA still produces readable assembly. For a retail app, symbol stripping is the appropriate level. Heavier obfuscation (string encryption, control-flow flattening via tools like iXGuard or Promon SHIELD) is typically reserved for fintech; verify with security team whether it's required here given ThreatMetrix is already in place.

2. Cryptographic primitives — what's used, where

let access = SecAccessControlCreateWithFlags(
    nil,
    kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
    [.biometryCurrentSet, .privateKeyUsage],
    nil
)
let attributes: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrAccessControl as String: access!,
    kSecAttrService as String: "com.costco.app.token",
    kSecValueData as String: tokenData,
]
SecItemAdd(attributes as CFDictionary, nil)

3. Secret management — hardcoded keys + URL audit

Recommended pattern: xcconfig + CI secrets

// Costco-Production.xcconfig (committed, no secrets)
ADOBE_ENV = production

// Costco-Production.private.xcconfig (gitignored)
ADOBE_LICENSE_KEY = abc123...
CONTENTSTACK_DELIVERY_TOKEN = xyz789...

// Build phase reads from environment in CI; from .private.xcconfig locally
// Info.plist references via $(VAR_NAME)

4. Anti-tampering / jailbreak / anti-debugging

// SwiftUI
@Environment(\.scenePhase) var scenePhase

var body: some View {
    ZStack {
        contentView
        if scenePhase != .active && isSensitiveScreenVisible {
            BlurView()
                .overlay(Image(systemName: "lock.fill").font(.largeTitle))
        }
    }
}

// UIKit
override func applicationWillResignActive(_ application: UIApplication) {
    privacyOverlay.show()
}
override func applicationDidBecomeActive(_ application: UIApplication) {
    privacyOverlay.hide()
}

let service = DCAppAttestService.shared
guard service.isSupported else { return /* fall back */ }

let keyId = try await service.generateKey()
let challenge = try await fetchServerChallenge()
let attestation = try await service.attestKey(keyId, clientDataHash: challenge)
// Send attestation to server; server verifies via Apple

5. Token & session security

kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly

6. Memory safety — wiping sensitive data

Swift String is immutable; sensitive data should land in [UInt8] or Data with an explicit zeroing step. Pattern:

extension Data {
    mutating func secureZero() {
        withUnsafeMutableBytes { buf in
            guard let baseAddress = buf.baseAddress else { return }
            memset_s(baseAddress, buf.count, 0, buf.count)
        }
    }
}

func authenticate(token: inout Data) async throws {
    defer { token.secureZero() }
    let request = buildRequest(token: token)
    try await network.send(request)
}

7. Secure logging

30+ print() sites identified in production code. Replace with os.Logger + privacy-aware interpolation:

import os

extension Logger {
    static let auth = Logger(subsystem: "com.costco.costco", category: "auth")
}

// Privacy-aware logging
Logger.auth.notice("OIDC token issued for member \(memberId, privacy: .private)")
Logger.auth.error("Token refresh failed: \(error.localizedDescription, privacy: .public)")

Custom SwiftLint rule:

# .swiftlint.yml
custom_rules:
  no_print_in_production:
    name: "print() in production"
    regex: "^\\s*print\\("
    severity: warning
    excluded:
      - ".*Tests.*"
      - ".*UITests.*"

8. ATS, certificate pinning & network security

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>img-cdn.costco.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
    </dict>
</dict>

9. Code signing & distribution integrity

10. Privacy Manifest (PrivacyInfo.xcprivacy)

Apple requires PrivacyInfo.xcprivacy for apps and SDKs accessing Required Reason APIs since 2024. Without it, App Review will reject submissions; SDKs without manifests block your release.

<!-- Costco/Costco/PrivacyInfo.xcprivacy -->
<plist version="1.0">
<dict>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array><string>CA92.1</string></array>
        </dict>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array><string>C617.1</string></array>
        </dict>
    </array>
    <key>NSPrivacyTracking</key>
    <false/>
</dict>
</plist>

For each third-party SDK (Adobe, Contentstack, NokNok, ThreatMetrix, SDWebImage, RZVinyl, RZTransitions): confirm the vendor ships PrivacyInfo.xcprivacy. If any don't, the app won't pass App Review.

11. Recommendations summary (prioritized)