Rule Definition
Insecure data storage vulnerabilities occur when development teams assume that users or malware will not have access to a mobile device's filesystem and subsequent sensitive information in data-stores on the device or are cloud synced.

Remediation
Other possible values are: - URLCredential.Persistence.none: Credential should not be stored. - URLCredentialPersistence.forSession: Credential should be stored only for this session. - URLCredentialPersistence.permanent: Credential should be stored in the Keychain.

Violation Code Sample

let credential = URLCredential.init(user: user, password: password, persistence: URLCredential.Persistence.synchronizable)
let shared = URLCredentialStorage.shared
let protectionSpace = URLProtectionSpace.init()
shared.setDefaultCredential(credential, for: protectionSpace)

Fixed Code Sample

let credential = URLCredential.init(user: user, password: password, persistence: URLCredential.Persistence.none)
let shared = URLCredentialStorage.shared
let protectionSpace = URLProtectionSpace.init()
shared.setDefaultCredential(credential, for: protectionSpace)

https://www.owasp.org/index.php/Mobile_Top_10_2016-M2-Insecure_Data_Storage