SHA256
Yuvomi Mobile Contributors
40a7962307
Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.
2.1 KiB
2.1 KiB
Native security review record
This is an engineering checklist, not an independent audit or release approval. The wrapper review is retained separately as historical evidence.
Implemented controls to exercise
- Origin-bound HTTPS API transports, no redirects, no production test-CA bypass.
- Server-owned session and CSRF semantics, no persistent password storage.
- Origin-bound AES-GCM/AndroidKeyStore cookies; iOS Keychain protected WhenUnlockedThisDeviceOnly with a private ephemeral URLSession jar.
- Bounded JSON reads, deadlines and no offline/ambiguous-write retry queue.
- Native permission-aware controls, destructive-action confirmation and server validation; partial update payloads preserve fields the native editor cannot edit.
- No WebView/WKWebView in either shipping source tree. Legacy tests do not prove this client's behavior; explicit native tests and source invariants are required.
Remaining gates
- Run Apple SDK typechecking, simulator/XCTest/UI and device checks; portable Foundation transport compilation is not SwiftUI/Security.framework validation.
- Review persistent-cookie expiry/removal, TLS failures, redirects, CSRF refresh, expired sessions, background/recreation and stale-response isolation on devices.
- Review migrations from the prototype: browser sessions are never imported and OS website data may remain until app-data reset/reinstall.
- Complete missing auth/provider protocols and permission/role scenarios before claiming native authentication parity, particularly SSO-only deployments.
- Implement/review files, notifications, offline storage and additional modules as actual native capabilities; do not restore the wrapper as a shortcut.
- Independently review the new UI/state/transport code, actual signed artifacts, accessibility, supported OS matrix and runner trust before distribution.
The owner-authorized signing configuration exists privately but its workflow changes are intentionally parked. A signed incomplete client is not a completed native product. Refer to native parity before release work.