Security Review

Review the current diff or specified files against CypherAir's security invariants.

Security Invariants Checklist

1. Zero network access — No HTTP, URLSession, NWConnection, no networked SDKs added.
2. No plaintext in logs — No print(), os_log(), or NSLog() of key material, passphrases, or decrypted content. Not even in DEBUG builds.
3. Memory zeroing — All sensitive Data buffers use resetBytes(in:). Rust side uses zeroize crate. Verify no early returns bypass zeroization.
4. AEAD hard-fail — Authentication failure during decryption must abort immediately. No partial plaintext returned.
5. SE wrapping scheme — HKDF info string ("CypherAir-SE-Wrap-v1:" + hexFingerprint) unchanged. Access control flags match the documented modes.
6. Permissions — Only NSFaceIDUsageDescription in Info.plist. No other usage descriptions added.
7. Secure random — Only SecRandomCopyBytes / CryptoKit (Swift) or (Rust). No , no .