On iOS, the practical way to reduce exposure of sensitive values during execution is to shorten how long they exist as plaintext and to notice anyone who tries to read or change them. Otukan keeps the tokens, keys and state you mark encoded while your app holds them, decodes each one only inside the call that needs it, overwrites marked buffers afterwards, and detects the debuggers, instrumentation and editing tools that memory attacks depend on. The sandbox already isolates apps on stock iPhones; this protection matters most where that isolation has been removed. For the cross-platform view, see mobile app memory protection.
Transient secrets and plaintext lifetime
Every secret your app uses spends time in memory. The question is how long, and in what form.
Where plaintext appears
| Value | Where it comes from | When it is plaintext without protection | With Otukan |
|---|---|---|---|
| Session and refresh tokens | Your login response | For the whole session, in every object that holds them | Encoded between requests, decoded inside the sending call |
| Keys read from the Keychain | Keychain query | From the read until the object is released | Decoded for the operation, buffer cleared afterwards |
| One-time codes and PINs | User input or push | Until the view and its model are released | Cleared once verification returns |
| Card or account data | API response | Until caches and view models are released | Encoded in models, decoded only for display |
| Game or reward state | Local logic | For the life of the process | Stored with integrity checks against editing |
Shorter exposure, fewer copies
Reducing lifetime is only half the job. Swift strings, collections and bridged Objective-C objects can quietly copy a value. Otukan’s approach is to keep secrets in buffers you control, decode into them for the shortest possible span, and clear them when the protected call returns. The Keychain and Secure Enclave remain the right place to store keys; key storage itself is covered on iOS app secrets protection.
Memory reading versus modification
Two different attackers target memory, and each needs a different answer.
Reading
The goal is to copy something valuable: a token to replay, a key to decrypt traffic, card data. On a jailbroken phone, a tool can obtain access to your process and dump its memory. Otukan reduces what a dump yields, because marked values are encoded between uses, and detects the debugger attachment and task access such tools rely on. When reading is detected, marked values are cleared and your backend can revoke the session.
Modification
The goal is to change something: a balance, a limit, a score, a feature flag. Editing tools search memory for a value and overwrite it. Otukan keeps integrity data for marked values and rejects a value that changed without your code changing it, so the app refuses to carry an edited balance into a transaction. Game-specific cases are covered on memory editing detection.
Matching the response to the value
Not every memory signal deserves the same answer. Reading tools near a session token call for revoking the session on your server, because the token may already be copied. An edited reward balance calls for rejecting the action and flagging the account, while the rest of the app keeps working. A dump attempt during onboarding may only need recording. Otukan lets you set these responses per flow, and the signal names the value involved so your backend can act precisely rather than end every session.
Application workflow and memory-pressure validation
iOS apps are suspended, woken and terminated constantly. Memory protection has to behave correctly through all of it.
What acceptance covers
- Sign in and complete your most sensitive flow on a physical device with the protected, distribution-signed build.
- Send the app to the background mid-flow and return, confirming values decode correctly.
- Trigger memory warnings and confirm cleared caches do not leave plaintext behind.
- Let iOS terminate the app, relaunch and confirm the session restores without exposing secrets.
- On a jailbroken lab device, attempt a dump and a value edit, and confirm the expected signals and responses.
- Repeat the journeys on a stock device and confirm nothing fires.
Each run records the iOS version, device, build and reviewer. For the platform overview, return to iOS app security; walkthroughs are in iOS app security guides.