Objective-C : Hardcoded sensitive data

Sensitive data is hardcoded. This may lead to an application data compromise.

Eliminating security risks related to hardcoded sensitive data (e.g. PIN codes, CVV numbers, etc.) is extremely difficult. This data is at least accessible to every developer of the application. Moreover, after the application is installed, removing sensitive data from its code is possible only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have an access to the source code to get access to the data. If it becomes known to an attacker, system administrators will be forced either to neglect the safety, or to restrict the access to the application.

In case of a mobile application, security threat is even higher, considering the risk of the device loss.