Insecure Data Storage

import Foundation
import Security

class SecureAuthManager {

    func saveToKeychain(key: String, value: String) -> Bool {
        guard let data = value.data(using: .utf8) else {
            return false
        }

        // Delete any existing item first
        let deleteQuery: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key
        ]
        SecItemDelete(deleteQuery as CFDictionary)

        // SECURE: Store in iOS Keychain with strong protection
        // Data is encrypted, excluded from backups, and
        // only accessible when the device is unlocked
        let addQuery: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String:
                kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]

        let status = SecItemAdd(addQuery as CFDictionary, nil)
        return status == errSecSuccess
    }

    func loadFromKeychain(key: String) -> String? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var result: AnyObject?
        let status = SecItemCopyMatching(
            query as CFDictionary, &result
        )

        guard status == errSecSuccess,
              let data = result as? Data,
              let value = String(data: data, encoding: .utf8)
        else {
            return nil
        }
        return value
    }

    func saveCredentials(username: String, password: String) {
        _ = saveToKeychain(key: "auth_username", value: username)
        _ = saveToKeychain(key: "auth_password", value: password)
    }

    func saveApiToken(_ token: String) {
        _ = saveToKeychain(key: "api_token", value: token)
    }
}

// With Keychain Services, credentials are encrypted by the
// Secure Enclave, excluded from device backups, and only
// accessible when the device is unlocked by the owner.
// Even with physical access, an attacker cannot extract
// the stored secrets without the device passcode.