Are credentials stored in plaintext in SharedPreferences/NSUserDefaults? - Is the local database encrypted? What algorithm and key derivation? - Are sensitive files stored on external storage (world-readable on Android)? - Is data persisted in screenshots/snapshots when the app backgrounds? - Does t