Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-016

Sensitive data copied to pasteboard

mediumSwiftCWE-200CVSS 5.5

What it detects

A password or secret is written to the general UIPasteboard, exposing it to other apps.

How to fix

Avoid placing secrets on the shared pasteboard, or mark items as expiring and local-only.

Vulnerable — Shield flags thisRecoveryCode.swift
import UIKit

func shareRecoveryCode(_ recoveryToken: String) {
    // Copy so the user can paste it into another app
    UIPasteboard.general.string = recoveryToken
}
Fixed — scans cleanRecoveryCode.swift
import UIKit

func shareRecoveryCode(_ recoveryToken: String) {
    // Local-only and expires after 60 seconds
    UIPasteboard.general.setItems(
        [[UIPasteboard.typeAutomatic: recoveryToken]],
        options: [.localOnly: true, .expirationDate: Date().addingTimeInterval(60)]
    )
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-016, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-016: Sensitive data copied to pasteboard — Zennoxa Shield