secure storage Shipped
What this lens looks for
Tokens, credentials, and any sensitive data must use platform secure storage, never plaintext configuration files, app settings, or unencrypted preference stores. On Swift/Apple, use Keychain Services and never store secrets in UserDefaults or plists. On Kotlin/Android, use EncryptedSharedPreferences or the Android Keystore and never store secrets in plain SharedPreferences. On C#/Windows, use DPAPI (ProtectedData.Protect/Unprotect with DataProtectionScope.CurrentUser) for Windows-only local secrets, and use .NET User Secrets (Microsoft.Extensions.Configuration.UserSecrets) only for development-time secrets since they are plaintext JSON unsuitable for production; never store tokens or credentials in plaintext config files or app settings.
What its verifier checks
All tokens, credentials, and sensitive data are kept in platform secure storage rather than plaintext config files, app settings, or unencrypted preference stores; Swift code uses Keychain Services and never UserDefaults or plists; Kotlin code uses EncryptedSharedPreferences or the Android Keystore and never plain SharedPreferences; C# code uses DPAPI for Windows-local secrets and confines User Secrets to development only, with no tokens or credentials in plaintext config or settings.