# Native security review record

This is an engineering checklist, not an independent audit or release approval.
The wrapper review is retained separately as
[historical evidence](legacy-wrapper-security-review.md).

## Implemented controls to exercise

- Origin-bound HTTPS API transports, no redirects, no production test-CA bypass.
- Server-owned session and CSRF semantics, no persistent password storage.
- Origin-bound AES-GCM/AndroidKeyStore cookies; iOS Keychain protected
  WhenUnlockedThisDeviceOnly with a private ephemeral URLSession jar.
- Bounded JSON reads, deadlines and no offline/ambiguous-write retry queue.
- Native permission-aware controls, destructive-action confirmation and server
  validation; partial update payloads preserve fields the native editor cannot edit.
- No WebView/WKWebView in either shipping source tree. Legacy tests do not prove
  this client's behavior; explicit native tests and source invariants are required.

## Remaining gates

1. Run Apple SDK typechecking, simulator/XCTest/UI and device checks; portable
   Foundation transport compilation is not SwiftUI/Security.framework validation.
2. Review persistent-cookie expiry/removal, TLS failures, redirects, CSRF refresh,
   expired sessions, background/recreation and stale-response isolation on devices.
3. Review migrations from the prototype: browser sessions are never imported and
   OS website data may remain until app-data reset/reinstall.
4. Complete missing auth/provider protocols and permission/role scenarios before
   claiming native authentication parity, particularly SSO-only deployments.
5. Implement/review files, notifications, offline storage and additional modules
   as actual native capabilities; do not restore the wrapper as a shortcut.
6. Independently review the new UI/state/transport code, actual signed artifacts,
   accessibility, supported OS matrix and runner trust before distribution.

The owner-authorized signing configuration exists privately but its workflow
changes are intentionally parked. A signed incomplete client is not a completed
native product. Refer to [native parity](native-parity.md) before release work.