security-privacy-scanner

Automatically scans for security and privacy issues — both known anti-patterns and missing/incomplete patterns that cause App Store rejections, security vulnerabilities, and privacy violations.

How to Use This Agent

Natural language (automatic triggering):

• "Can you check my code for security issues?"
• "I need to prepare for App Store security review"
• "Are there any hardcoded credentials in my codebase?"
• "Do I need a Privacy Manifest?"
• "Check if I'm storing tokens securely"

Explicit command:

/axiom:audit security

Covers privacy too — Privacy Manifests, sensitive-data storage, and logging. There is no separate privacy area.

What It Does

Maps your security and privacy posture (Privacy Manifest presence, credential storage pattern, network transport, logging discipline, ATT usage, export compliance), then detects and reasons about:

Critical (App Store Rejection or Credential Exposure)

• Hardcoded API keys – AWS keys, OpenAI keys, GitHub tokens extractable from binary
• Missing Privacy Manifest – Required Reason APIs used without declaration (App Store Connect blocks since May 2024)
• ATT API without usage description – Runtime crash + automatic rejection
• Missing usage descriptions for privacy-sensitive APIs that are actually called (runtime crash)

High (Security Vulnerabilities)

• Insecure token storage – Auth tokens in @AppStorage/UserDefaults, backup-extractable
• HTTP URLs / ATS violations – Cleartext credential transit
• Sensitive data in logs – Credentials in sysdiagnose, crash reports, support tooling
• Missing Keychain migration path – Upgrade users still carry plaintext tokens
• Third-party SDK manifests missing – Bundled SDKs without their own PrivacyInfo.xcprivacy
• Missing export compliance declaration – Submission blocked when using CryptoKit/CommonCrypto

Medium (Best Practices)

• Missing SSL pinning for sensitive endpoints (payments, health, enterprise)
• Weak Keychain ACL – Tokens with .kSecAttrAccessibleAlways or .AfterFirstUnlock instead of .WhenUnlockedThisDeviceOnly
• Unused entitlements – Expanded attack surface (Keychain sharing, App Groups, iCloud, HealthKit claimed but not used)
• Missing snapshot protection – Task switcher snapshot exposes sensitive screens
• Raw user IDs in analytics – PII sent to third-party services

Privacy Manifest Coverage

Cross-references every Required Reason API detected in code against declarations in PrivacyInfo.xcprivacy — flags partial coverage that causes rejection.

Compound Findings

Findings that intersect carry elevated severity — e.g., hardcoded API key + HTTP endpoint means the key transmits in cleartext; insecure token storage + no Keychain migration path means every upgrade user remains exposed.

Security Posture

Overall security rating: HARDENED / GAPS / VULNERABLE based on credentials, manifest status, token storage, network transport, logging hygiene, ATT compliance, export compliance, and entitlement scope.

Related

• privacy-ux – Privacy-first UX patterns
• storage – Secure storage patterns including Keychain
• iap-auditor agent — Adjacent receipt-validation security concerns
• storage-auditor agent — Compound with insecure token storage findings
• networking-auditor agent — Compound with HTTP endpoints carrying auth