SecureStorage

Register the native iOS secure-storage tool suite to read and mutate Keychain values under explicit key allow-lists.

Warning: Every tool in this suite is Critical because it can expose or mutate secrets. Keep the allow-list narrow and only enable this suite when you explicitly need secure-storage inspection or repair.

Install

Published pod: AnsightToolsSecureStorage.

SwiftPM:

.product(name: "AnsightToolsSecureStorage", package: "ansight-sdk")

CocoaPods:

pod 'AnsightToolsSecureStorage', '1.4.0-preview.1'

Register the Suite

import AnsightCore
import AnsightToolsSecureStorage

let secureStorage = AnsightSecureStorageToolsOptions.createBuilder()
    .withAppleService("com.example.app")
    .allowKeyPrefix("debug.")
    .build()

try AnsightRuntime.shared.registerSecureStorageTools(options: secureStorage)

Registration API

  • registerSecureStorageTools(options:): registers the suite.
  • AnsightSecureStorageToolsOptions.createBuilder(): creates a suite options builder.
  • withStorageIdentifier(...): sets the storage identifier.
  • withAppleService(...): sets the Keychain service.
  • allowKey(...) / allowKeyPrefix(...): allow specific keys or key prefixes.

Specific Concerns

  • Values may contain credentials, tokens, or other secrets.
  • Keep key allow-lists narrow.
  • All secure-storage tools use .critical, including reads, and require .fullAccess because their values are secrets.

Tool Matrix

NameIdPolicyDescription
Get Secure Storage Valuesecure.get_valueCriticalReads a Keychain value from the configured service.
Set Secure Storage Valuesecure.set_valueCriticalWrites a Keychain value.
Remove Secure Storage Keysecure.remove_keyCriticalDeletes a Keychain value.

Tool Details

Use secure.get_value only for explicit local debugging. Use secure.set_value and secure.remove_key only when repairing a local development session and the key allow-list is narrow.