SHA256
Yuvomi Mobile Contributors
40a7962307
Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.
37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# Native security review record
|
|
|
|
This is an engineering checklist, not an independent audit or release approval.
|
|
The wrapper review is retained separately as
|
|
[historical evidence](legacy-wrapper-security-review.md).
|
|
|
|
## Implemented controls to exercise
|
|
|
|
- Origin-bound HTTPS API transports, no redirects, no production test-CA bypass.
|
|
- Server-owned session and CSRF semantics, no persistent password storage.
|
|
- Origin-bound AES-GCM/AndroidKeyStore cookies; iOS Keychain protected
|
|
WhenUnlockedThisDeviceOnly with a private ephemeral URLSession jar.
|
|
- Bounded JSON reads, deadlines and no offline/ambiguous-write retry queue.
|
|
- Native permission-aware controls, destructive-action confirmation and server
|
|
validation; partial update payloads preserve fields the native editor cannot edit.
|
|
- No WebView/WKWebView in either shipping source tree. Legacy tests do not prove
|
|
this client's behavior; explicit native tests and source invariants are required.
|
|
|
|
## Remaining gates
|
|
|
|
1. Run Apple SDK typechecking, simulator/XCTest/UI and device checks; portable
|
|
Foundation transport compilation is not SwiftUI/Security.framework validation.
|
|
2. Review persistent-cookie expiry/removal, TLS failures, redirects, CSRF refresh,
|
|
expired sessions, background/recreation and stale-response isolation on devices.
|
|
3. Review migrations from the prototype: browser sessions are never imported and
|
|
OS website data may remain until app-data reset/reinstall.
|
|
4. Complete missing auth/provider protocols and permission/role scenarios before
|
|
claiming native authentication parity, particularly SSO-only deployments.
|
|
5. Implement/review files, notifications, offline storage and additional modules
|
|
as actual native capabilities; do not restore the wrapper as a shortcut.
|
|
6. Independently review the new UI/state/transport code, actual signed artifacts,
|
|
accessibility, supported OS matrix and runner trust before distribution.
|
|
|
|
The owner-authorized signing configuration exists privately but its workflow
|
|
changes are intentionally parked. A signed incomplete client is not a completed
|
|
native product. Refer to [native parity](native-parity.md) before release work.
|