Rule Definition
Insecure data storage vulnerabilities occur when development teams assume that users or malware will not have access to a mobile device's filesystem and subsequent sensitive information in data-stores on the device or are cloud synced.

Remediation
Other possible values are: - NSURLCredentialPersistenceNone: Credential should not be stored. - NSURLCredentialPersistenceForSession: Credential should be stored only for this session. - NSURLCredentialPersistencePermanent: Credential should be stored in the Keychain.

Violation Code Sample

NSURLCredential *credential = [NSURLCredential credentialWithUser:user password:password persistence:NSURLCredentialPersistenceSynchronizable];
    NSURLCredentialStorage *shared = [NSURLCredentialStorage sharedCredentialStorage];
    [shared setDefaultCredential:credential forProtectionSpace:protectionSpace];

Fixed Code Sample

NSURLCredential *credential = [NSURLCredential credentialWithUser:user password:password persistence:NSURLCredentialPersistenceNone];
    NSURLCredentialStorage *shared = [NSURLCredentialStorage sharedCredentialStorage];
    [shared setDefaultCredential:credential forProtectionSpace:protectionSpace]; 

https://www.owasp.org/index.php/Mobile_Top_10_2016-M2-Insecure_Data_Storage