A token, secret, or credential is bound to @AppStorage.

Why this matters

@AppStorage is a thin SwiftUI wrapper over UserDefaults, so the value lands in an unencrypted on-disk plist that is readable from a device backup, a jailbroken device, or the simulator container (CWE-312). AI-generated SwiftUI code reaches for @AppStorage for persistence and unknowingly stores authentication material in the clear.

Keep @AppStorage for non-sensitive UI preferences. Store secrets in the Keychain (Security framework or a wrapper) and read them into memory when needed instead of persisting them through @AppStorage.

import SwiftUI

struct SettingsView: View {
    // ruleid: auth.swift.storage.token-in-appstorage
    @AppStorage("accessToken") var accessToken: String = ""

    // ruleid: auth.swift.storage.token-in-appstorage
    @AppStorage("refresh_token") private var refreshToken = ""

    // ruleid: auth.swift.storage.token-in-appstorage
    @AppStorage("apiSecret") var apiSecret = ""

    var body: some View {
        Text(accessToken)
    }
}

import SwiftUI

struct SettingsView: View {
    // Non-sensitive UI preferences are the intended use of @AppStorage.
    @AppStorage("username") var username: String = ""
    @AppStorage("prefersDark") var prefersDark = false
    @AppStorage("launchCount") private var launchCount = 0

    var body: some View {
        Text(username)
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.swift.storage.token-in-appstorage -- <reason>

References