Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[advisory/missing_security_tradeoff] The note implies that Swift Confidential does not prevent all forms of credential exposure, but it lacks a clear discussion of the trade-offs involved in using such obfuscation techniques. Evidence: "So Swift Confidential protects mainly against easy static extraction with tools like strings, but it does not stop a determined attacker from debugging the app, hooking the getter, dumping memory, or patching the login result." Why it matters: Understanding the limitations of security measures is crucial for developers to make informed decisions about how to protect sensitive data. Suggestion: Include a discussion on the trade-offs of using obfuscation techniques versus other security measures, such as secure storage.

[advisory/unsupported_claim] The claim that Swift Confidential can prevent straightforward recovery of secret values through obfuscation is overstated without clear evidence of effectiveness against determined attackers. Evidence: "Prevent straightforward recovery of secret values by using Swift Confidential’s build-time obfuscation and runtime deobfuscation process." Why it matters: Obfuscation can deter casual reverse engineering but does not guarantee protection against skilled attackers who may still extract sensitive information. Suggestion: Obfuscation can make it more difficult for casual attackers to recover secret values, but it does not provide complete security against determined reverse engineering efforts.

[advisory/incorrect_mechanism] The suggestion to use a `confidential.yml` file for storing credentials is not a standard or secure practice in iOS development. Evidence: "Prevent plaintext credential exposure by moving hardcoded Swift string literals, such as usernames and passwords, into a `confidential.yml` file" Why it matters: Storing sensitive information in a separate file that is not properly secured can lead to exposure of credentials if the file is not adequately protected or excluded from the app bundle. Suggestion: Prevent plaintext credential exposure by using secure storage mechanisms such as the Keychain instead of moving hardcoded Swift string literals into a `confidential.yml` file.

[advisory/step_action] The step should start with a clear action verb to enhance clarity. Source text: 7. Detect remaining plaintext credential exposure by rebuilding the application, extracting the IPA, and checking the compiled binary using `strings` and static analysis tools to verify that the original plaintext credential values no longer appear directly in the binary. Suggested rewrite: Store encryption keys as obfuscated key bytes and recover them only at runtime by XORing the key bytes with nonce bytes to prevent simple recovery of encrypted secret values.

[advisory/step_action] The step should start with a clear action verb to enhance clarity. Source text: 4. Prevent direct use of plaintext credentials in source code by updating the application code to reference the generated secret values, such as `Secrets.demoEmail` and `Secrets.demoPassword` (screenshot 5). Suggested rewrite: Update the application code to reference the generated secret values, such as `Secrets.demoEmail` and `Secrets.demoPassword`, to prevent direct use of plaintext credentials in source code.

[advisory/step_action] The step should start with a clear action verb to enhance clarity. Source text: 3. Prevent easy static extraction of secret values by allowing Swift Confidential to generate obfuscated Swift code that reconstructs the secret values at runtime instead of leaving the original strings directly in the source file and compiled binary. Suggested rewrite: Allow Swift Confidential to generate obfuscated Swift code that reconstructs the secret values at runtime to prevent easy static extraction of secret values.

[advisory/step_action] The step should start with a clear action verb to enhance clarity. Source text: 2. Prevent plaintext credentials from appearing directly in the compiled binary by adding the Swift Confidential packages to the Xcode project and processing `confidential.yml` with the Swift Confidential build plugin (screenshots 2 - 4) during the application build process. Suggested rewrite: Add the Swift Confidential packages to the Xcode project and process `confidential.yml` with the Swift Confidential build plugin during the application build process to prevent plaintext credentials from appearing directly in the compiled binary.

[advisory/step_action] The step should start with a clear action verb to enhance clarity. Source text: ## platform-feature-01-risk-01-control-01 Suggested rewrite: Move hardcoded Swift string literals, such as usernames and passwords, into a `confidential.yml` file instead of writing the credentials directly in the Swift source file.