[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$apiParty6fBuHLCPZ1LTYs42XHdVbjpSDOYYPYzyxeAGwSN5Tp8":3,"$apiPartyTROaEUqBO-p1Q4PD5--5zSwGkL4nHI188BF-Ox7xDjo":563,"$apiPartyTROaEUqBO-p1Q4PD5--5zSwGkL4nHI188BF-Ox7xDjo$H93EERW16b":563},{"product_data":4,"scene_data":21,"task_data":407,"modality_data":441,"domain_data":478},[5,9,12,15,18],{"name":6,"value":7,"add_value":8,"describe":8},"Rivo","1","",{"name":10,"value":11,"add_value":8,"describe":8},"Cubo","2",{"name":13,"value":14,"add_value":8,"describe":8},"Moye","3",{"name":16,"value":17,"add_value":8,"describe":8},"Juro","4",{"name":19,"value":20,"add_value":8,"describe":8},"Ordo","5",[22,73,135,197,232,267,302,337,372],{"name":23,"value":7,"add_value":24,"describe":25,"children":26},"Home & Indoor","sofa","AI enhances everyday home life. Our datasets cover real indoor scenes to support smart devices, robotics, and home intelligence.",[27,29,31,33,35,37,40,43,46,49,52,55,58,61,64,67,70],{"name":28,"value":7},"Living Room",{"name":30,"value":11},"Bedroom",{"name":32,"value":14},"Kitchen",{"name":34,"value":17},"Dining Area",{"name":36,"value":20},"Bathroom",{"name":38,"value":39},"Entrance \u002F Foyer","6",{"name":41,"value":42},"Corridor \u002F Hallway","7",{"name":44,"value":45},"Staircase","8",{"name":47,"value":48},"Home Office","9",{"name":50,"value":51},"Hobby \u002F Game Room","10",{"name":53,"value":54},"Worship Space","11",{"name":56,"value":57},"Garage","12",{"name":59,"value":60},"Utility \u002F Laundry Room","13",{"name":62,"value":63},"Pantry","14",{"name":65,"value":66},"Basement","15",{"name":68,"value":69},"Garden","16",{"name":71,"value":72},"Balcony","17",{"name":74,"value":11,"add_value":75,"describe":76,"children":77},"Office & Educational","workshop","AI is reshaping work and learning. Our datasets capture offices and classrooms to power automation and next-generation productivity tools.",[78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132],{"name":79,"value":80},"Open Office","18",{"name":82,"value":83},"Private Office","19",{"name":85,"value":86},"Co-working Space","20",{"name":88,"value":89},"Reception \u002F Lobby","21",{"name":91,"value":92},"Conference Room","22",{"name":94,"value":95},"Huddle Room \u002F Booth","23",{"name":97,"value":98},"Lecture Hall \u002F Auditorium","24",{"name":100,"value":101},"Classroom","25",{"name":103,"value":104},"Science Laboratory","26",{"name":106,"value":107},"Library","27",{"name":109,"value":110},"Design Studio","28",{"name":112,"value":113},"Pantry \u002F Breakroom","29",{"name":115,"value":116},"Cafeteria \u002F Canteen","30",{"name":118,"value":119},"Restroom (Commercial)","31",{"name":121,"value":122},"Gymnasium \u002F Sports Hall","32",{"name":124,"value":125},"Server Room","33",{"name":127,"value":128},"Mailroom \u002F Logistics","34",{"name":130,"value":131},"Janitorial Closet","35",{"name":133,"value":134},"Corridor \u002F Elevators","36",{"name":136,"value":14,"add_value":137,"describe":138,"children":139},"Healthcare & Medical","love-and-help","AI is advancing modern healthcare. Our datasets include clinics and hospitals to enable clinical insights and medical automation.",[140,143,146,149,152,155,158,161,164,167,170,173,176,179,182,185,188,191,194],{"name":141,"value":142},"Operating Theatre \u002F OR","37",{"name":144,"value":145},"Consultation Room","38",{"name":147,"value":148},"Treatment Room","39",{"name":150,"value":151},"Dental Clinic","40",{"name":153,"value":154},"Inpatient Ward","41",{"name":156,"value":157},"Nurse Station","42",{"name":159,"value":160},"ICU","43",{"name":162,"value":163},"NICU (Neonatal ICU)","44",{"name":165,"value":166},"Emergency Room (ER)","45",{"name":168,"value":169},"Hospital Corridor","46",{"name":171,"value":172},"Waiting Area","47",{"name":174,"value":175},"CT\u002FMRI","48",{"name":177,"value":178},"Medical Laboratory","49",{"name":180,"value":181},"Phlebotomy Room","50",{"name":183,"value":184},"Rehabilitation Gym","51",{"name":186,"value":187},"Assisted Living Room","52",{"name":189,"value":190},"Pharmacy","53",{"name":192,"value":193},"Sterile Processing Dept","54",{"name":195,"value":196},"Medical Storage","55",{"name":198,"value":17,"add_value":199,"describe":200,"children":201},"Business & Public Service","business","AI is elevating commercial and public services. Our datasets span retail, dining, and service centers to improve intelligent operations.",[202,205,208,211,214,217,220,223,226,229],{"name":203,"value":204},"Shopping Mall Atrium","86",{"name":206,"value":207},"Supermarket Shelf","87",{"name":209,"value":210},"Self-Checkout Counter","88",{"name":212,"value":213},"Restaurant Dining Hall","89",{"name":215,"value":216},"Commercial Kitchen","90",{"name":218,"value":219},"Hotel Lobby","91",{"name":221,"value":222},"Subway Platform","92",{"name":224,"value":225},"Security Checkpoint","93",{"name":227,"value":228},"Underground Parking","94",{"name":230,"value":231},"Bank Teller Zone","95",{"name":233,"value":20,"add_value":234,"describe":235,"children":236},"Industrial & Manufacturing","robot-arm","AI is modernizing industry. Our datasets capture factories and logistics spaces to support robotics and intelligent manufacturing.",[237,240,243,246,249,252,255,258,261,264],{"name":238,"value":239},"Final Assembly Line","96",{"name":241,"value":242},"Quality Control Station","97",{"name":244,"value":245},"Robotic Welding Cell","98",{"name":247,"value":248},"CNC Machining Center","99",{"name":250,"value":251},"Cleanroom","100",{"name":253,"value":254},"Automated Warehouse","101",{"name":256,"value":257},"Loading Dock","102",{"name":259,"value":260},"Sorting Center","103",{"name":262,"value":263},"Chemical Plant","104",{"name":265,"value":266},"Power Substation","105",{"name":268,"value":39,"add_value":269,"describe":270,"children":271},"Transportation & Driving","car","AI is revolutionizing mobility. Our datasets capture road networks, vehicle dynamics and traffic scenarios to support autonomous driving and intelligent transportation systems.",[272,275,278,281,284,287,290,293,296,299],{"name":273,"value":274},"Urban Intersection","56",{"name":276,"value":277},"Highway \u002F Expressway","57",{"name":279,"value":280},"Tunnel","58",{"name":282,"value":283},"Roundabout","59",{"name":285,"value":286},"School \u002F Hospital Zone","60",{"name":288,"value":289},"Toll Station","61",{"name":291,"value":292},"Construction Zone","62",{"name":294,"value":295},"Parking Garage","63",{"name":297,"value":298},"Driver Cabin","64",{"name":300,"value":301},"Adverse Weather","65",{"name":303,"value":42,"add_value":304,"describe":305,"children":306},"Outdoor & Construction","tent-tree","AI is optimizing outdoor operations. Our datasets capture construction sites, open-air work zones and outdoor infrastructure to support smart construction and autonomous outdoor machinery.",[307,310,313,316,319,322,325,328,331,334],{"name":308,"value":309},"Excavation Site","66",{"name":311,"value":312},"Scaffolding Area","67",{"name":314,"value":315},"Material Storage Yard","68",{"name":317,"value":318},"Site Entrance","69",{"name":320,"value":321},"Roadwork Zone","70",{"name":323,"value":324},"Bridge Infrastructure","71",{"name":326,"value":327},"Transmission Line","72",{"name":329,"value":330},"Open-pit Mine","73",{"name":332,"value":333},"Tunneling Site","74",{"name":335,"value":336},"Post-Disaster Rubble","75",{"name":338,"value":45,"add_value":339,"describe":340,"children":341},"Nature, Aerial & Aquatic","global-loop","AI is exploring the natural world. Our datasets capture terrestrial landscapes, aerial vistas and aquatic ecosystems to support environmental monitoring and autonomous exploration systems.",[342,345,348,351,354,357,360,363,366,369],{"name":343,"value":344},"Deep Forest","76",{"name":346,"value":347},"Farmland \u002F Crops","77",{"name":349,"value":350},"River \u002F Lake","78",{"name":352,"value":353},"Open Ocean","79",{"name":355,"value":356},"Underwater Coral Reef","80",{"name":358,"value":359},"Fish Farm","81",{"name":361,"value":362},"Mountain Terrain","82",{"name":364,"value":365},"Urban Low Altitude","83",{"name":367,"value":368},"Fire Scene","84",{"name":370,"value":371},"Desert \u002F Gobi","85",{"name":373,"value":48,"add_value":374,"describe":375,"children":376},"Virtul & Digital","siri","AI is reshaping the virtual realm. Our datasets capture digital twins, virtual environments and simulated spaces to support metaverse development and intelligent digital interaction.",[377,380,383,386,389,392,395,398,401,404],{"name":378,"value":379},"VR Social Space","106",{"name":381,"value":382},"Synthetic Driving Sim","107",{"name":384,"value":385},"Digital Twin City","108",{"name":387,"value":388},"FPS \u002F MOBA Game","109",{"name":390,"value":391},"Robotics Gym","110",{"name":393,"value":394},"AR Navigation","111",{"name":396,"value":397},"Virtual Showroom","112",{"name":399,"value":400},"Code \u002F IDE Interface","113",{"name":402,"value":403},"App GUI Screen","114",{"name":405,"value":406},"Synthetic Face\u002FID","115",[408,411,414,417,420,423,426,429,432,435,438],{"name":409,"value":7,"add_value":410,"describe":8},"Classification","rubric",{"name":412,"value":11,"add_value":413,"describe":8},"Detection","radar",{"name":415,"value":14,"add_value":416,"describe":8},"Segmentation","segmentation",{"name":418,"value":17,"add_value":419,"describe":8},"Tacking","crosshairs",{"name":421,"value":20,"add_value":422,"describe":8},"Estimation","streamline",{"name":424,"value":39,"add_value":425,"describe":8},"QA","qa",{"name":427,"value":42,"add_value":428,"describe":8},"Recognition","finger-scan",{"name":430,"value":45,"add_value":431,"describe":8},"Control","control",{"name":433,"value":48,"add_value":434,"describe":8},"Extraction","extraction",{"name":436,"value":51,"add_value":437,"describe":8},"Retrieval","retrieval",{"name":439,"value":54,"add_value":440,"describe":8},"Forecast","forecast",[442,445,448,451,454,457,460,463,466,469,472,475],{"name":443,"value":7,"add_value":444,"describe":8},"Audio","audio",{"name":446,"value":11,"add_value":447,"describe":8},"Image","image",{"name":449,"value":14,"add_value":450,"describe":8},"Text","text",{"name":452,"value":17,"add_value":453,"describe":8},"Video","video",{"name":455,"value":20,"add_value":456,"describe":8},"Multi","multi",{"name":458,"value":39,"add_value":459,"describe":8},"Document","document",{"name":461,"value":42,"add_value":462,"describe":8},"Time-Series","time-series",{"name":464,"value":45,"add_value":465,"describe":8},"3D cloud","cloud",{"name":467,"value":48,"add_value":468,"describe":8},"Code","code",{"name":470,"value":51,"add_value":471,"describe":8},"Event","event",{"name":473,"value":54,"add_value":474,"describe":8},"Motion","motion",{"name":476,"value":57,"add_value":477,"describe":8},"Interaction","interaction",[479,482,487,491,494,499,504,509,514,519,524,528,532,536,540,544,548,552,556,559],{"id":480,"value":480,"name":233,"intro":481,"add_value":234,"describe":481},2,"智能质检：利用图像识别、多模态模型对产品外观或声音、振动等数据进行分析，自动识别缺陷，提高质量控制效率。\n工业知识问答与文档理解：通过大模型理解和总结技术文档、操作手册，实现快速问答、知识检索和培训支持。\n安全监测与风险预警：实时分析视频、传感器和操作日志，识别潜在危险行为或异常状态，提前预警，保障人员和设备安全。",{"id":483,"value":483,"name":484,"intro":485,"add_value":486,"describe":485},3,"Finance & Insurance","风险评估与预测：分析大量客户数据，评估信用风险、市场风险等，预测违约概率、股价走势等，辅助金融机构决策。\n智能投顾：根据客户风险偏好、资产状况等，提供个性化投资组合建议，实时调整投资策略。\n反欺诈检测：通过分析交易数据、用户行为，识别异常交易和欺诈行为，保障金融安全。","funds",{"id":488,"value":488,"name":489,"intro":490,"add_value":269,"describe":490},1,"Transport & Automotive","智能座舱：打造多模态交互的 AI 座舱，通过语音、手势、面部识别等实现人机交互，如语音控制导航、音乐播放。\n驾驶员状态监测：识别疲劳、分心、抽烟、打电话等行为，通过大模型判断危险等级，触发相应提醒或干预机制。\n智能驾驶：AI 用于环境感知、路径规划与决策控制，使车辆能识别道路、行人、障碍物等，实现自适应巡航、自动泊车、车道保持等功能，提升驾驶安全性与便利性。",{"id":492,"value":492,"name":136,"intro":493,"add_value":137,"describe":493},4,"医学影像诊断：分析 CT、MRI 等影像，辅助医生检测疾病、识别病灶，如 AI 系统可快速发现肺部结节。\n医患对话助手：通过自然语言处理理解患者问题，提供初步健康建议或就诊指导，缓解医生接诊压力。\n智能健康管理：根据用户健康数据，提供个性化健康建议、疾病预警，如智能手环结合 AI 分析用户运动、睡眠、心率等数据。",{"id":495,"value":495,"name":496,"intro":497,"add_value":498,"describe":497},6,"Smart Devices","多模态交互：支持语音、手势、眼神等多种交互方式，如 AI 眼镜可通过语音指令实现翻译、搜索功能。\n智能感知与处理：使设备能感知环境、理解用户需求，如智能音箱根据环境噪音自动调节音量。\n个性化服务：根据用户使用习惯和偏好，提供个性化功能与服务，如智能手表为用户定制运动健身计划。","microscope",{"id":500,"value":500,"name":501,"intro":502,"add_value":503,"describe":502},8,"Law & Government","智能法律问答：面向公众或企业用户，提供合规、劳动法、婚姻继承、知识产权等常见法律问题的智能解答。\n合同审查与风险识别：利用大模型分析合同内容，识别潜在风险条款、漏洞或不合理约定，提升合同审核质量。\n法律知识图谱构建：自动梳理法规、案例、条文之间的引用关系，构建语义化知识图谱，支持智能分析和推理。","hammer",{"id":505,"value":505,"name":506,"intro":507,"add_value":508,"describe":507},7,"Education & Training","个性化学习：根据学生学习进度、能力和知识掌握情况，推送个性化学习内容与练习，如智能辅导系统为学生制定专属学习计划。\n智能教学辅助：AI 助教协助教师进行作业批改、答疑解惑，还可分析教学数据，为教师提供教学反馈，优化教学方法。\n虚拟学习环境：利用 AI 创建虚拟实验、历史场景等，让学生沉浸式学习，如在虚拟化学实验室中进行实验操作。","degree-hat",{"id":510,"value":510,"name":511,"intro":512,"add_value":513,"describe":512},5,"Agriculture & Food","作物病虫害识别与防治：通过图像识别分析农作物叶片、果实等症状，识别病虫害类型，给出防治建议，减少产量损失。\n农产品质量检测：利用图像和传感器数据，识别果蔬等农产品的成熟度、外观缺陷，进行自动分级，提高市场竞争力。\n农情监测与预测：利用卫星遥感、气象和传感器数据，结合大模型预测作物长势、干旱、洪涝等农情变化。","ph-farm",{"id":515,"value":515,"name":516,"intro":517,"add_value":518,"describe":517},9,"Retail & E-commerce","智能客服：通过自然语言对话理解用户需求，提供产品推荐、订单查询、退换货支持等服务，提升客户满意度。\n个性化营销推荐：基于用户浏览、购买、偏好等行为数据，生成个性化推荐内容与优惠策略，提高转化率和客单价。\n商品内容生成：自动撰写商品标题、卖点描述、使用说明等内容，适用于海量SKU的内容生产与多语言发布。","buy",{"id":520,"value":520,"name":521,"intro":522,"add_value":523,"describe":8},10,"Security & Protection",null,"safe-shield-line",{"id":525,"value":525,"name":526,"intro":522,"add_value":527,"describe":8},11,"Environment & Climate","weather",{"id":529,"value":529,"name":530,"intro":522,"add_value":531,"describe":8},12,"Energy & Resource","energy-leaf",{"id":533,"value":533,"name":534,"intro":522,"add_value":535,"describe":8},13,"Express & Logistics","speed-outline",{"id":537,"value":537,"name":538,"intro":522,"add_value":539,"describe":8},15,"Sports","baseball-outline",{"id":541,"value":541,"name":542,"intro":522,"add_value":543,"describe":8},16,"General Data","daily-booth",{"id":545,"value":545,"name":546,"intro":522,"add_value":547,"describe":8},17,"Content & Media","media",{"id":549,"value":549,"name":550,"intro":522,"add_value":551,"describe":8},18,"Construction","construction",{"id":553,"value":553,"name":554,"intro":522,"add_value":555,"describe":8},19,"IT & Telecom","tech",{"id":557,"value":557,"name":558,"intro":522,"add_value":498,"describe":8},20,"Science & Research",{"id":560,"value":560,"name":561,"intro":522,"add_value":562,"describe":8},21,"Language & Culture","lang",{"id":564,"unique_code":565,"title":566,"icon":8,"intro":567,"cate":483,"detail":568,"create_time":569,"update_time":570,"price":571,"view_count":480,"download_count":572,"unit":572,"amount":573,"is_create_order":572,"enterprise_id":488,"seo_keywords":574,"seo_description":575,"data_format":576,"file_size":577,"apply_scene":578,"training_task":579,"version":580,"dataset_type_id":492,"dataset_scene_id":520,"sample_file":581,"banner":8,"unit_name":8,"cate_name":449,"icon_url":8,"banner_url":8,"sample_file_url":8,"data_dict":582,"qa_list":618,"sample_metadatas":635,"text_sample_content":671,"enterprise_name":672,"enterprise_logo":673,"data_distribution":674},1319,"0cd01c8b2b0d3831b4315d505e43cbe7","iOS Application Security Analysis Question Answering Dataset","Train models to analyze iOS application security evidence and deliver expert-level answers grounded in platform knowledge.","\u003Cp>This structured dataset covers questions about iOS application security, including Keychain usage, permissions and privacy disclosures, URL Schemes, App Transport Security (ATS) configuration, and data storage behavior. It pairs textual configuration or behavioral evidence with expert answers, evidence-based security analysis, risk levels, and practical recommendations. It supports mobile application security QA, domain-specific supervised fine-tuning, model evaluation, and security analysis research.\u003C\u002Fp>","2026-10-17 17:59:13","2026-10-19 17:18:42","0.00",0,5000,"iOS security dataset,mobile app security QA,Keychain security analysis,ATS configuration analysis,URL Scheme security,privacy disclosure assessment,iOS security SFT,application risk assessment","Structured iOS security QA covering Keychain, privacy disclosures, URL Schemes, ATS, and data storage for expert answers, risk analysis, and domain SFT.","JSON","0.3GB","iOS application security assessment, mobile vulnerability analysis, application security auditing","security question answering, vulnerability analysis, evidence-based reasoning","V1.0","rivo\u002Fsample-packages\u002F79d79f80-0830-4101-bbb3-21036e7203af\u002F20261017.zip",[583,588,593,598,603,608,613],{"id":572,"name":584,"field":585,"intro":586,"type":587},"File Name","file_name","File name","string",{"id":589,"name":590,"field":591,"intro":592,"type":587},9736,"Configuration or Behavior Evidence","evidence","Textual evidence supplied for analysis, such as Keychain usage, privacy declarations, URL Scheme settings, ATS configuration, or data storage behavior.",{"id":594,"name":595,"field":596,"intro":597,"type":587},9737,"Security Question","question","The original question about an iOS application's security, configuration, privacy, or data storage behavior.",{"id":599,"name":600,"field":601,"intro":602,"type":587},9738,"Risk Level","risk_level","The assessed overall security risk level, based on the evidence and its likely impact.",{"id":604,"name":605,"field":606,"intro":607,"type":587},9739,"Expert Answer","expert_answer","A detailed answer that combines relevant iOS platform knowledge with the supplied evidence to address the question.",{"id":609,"name":610,"field":611,"intro":612,"type":587},9740,"Security Recommendations","recommendations","Practical remediation or validation steps appropriate to the identified risks and iOS security context.",{"id":614,"name":615,"field":616,"intro":617,"type":587},9741,"Security Analysis","security_analysis","An evidence-based explanation of the security properties, risks, and limitations relevant to the application's behavior or configuration.",[619,623,627,631],{"id":620,"question":621,"answer":622},6729,"Which iOS security topics are covered?","The dataset covers Keychain usage, permissions and privacy disclosures, URL Schemes, App Transport Security (ATS) configuration, and data storage behavior. Textual configuration or behavioral evidence supports analysis of specific security questions.",{"id":624,"question":625,"answer":626},6730,"What information does each record contain?","The schema includes a security question, configuration or behavioral evidence, an expert answer, security analysis, a risk level, and security recommendations. This structure helps train models to connect evidence with relevant iOS platform knowledge.",{"id":628,"question":629,"answer":630},6731,"Which training and evaluation tasks does it support?","It supports generative question answering, evidence-based analysis, risk assessment, and security recommendation generation for mobile application security. It can also be used for domain-specific supervised fine-tuning or to evaluate a model's understanding of iOS security.",{"id":632,"question":633,"answer":634},6732,"What are the dataset size, delivery method, and licensing terms?","The current product information does not specify the sample count, delivery format, or licensing terms. Before acquisition, review the product listing for specifications and license details, including permitted use, redistribution restrictions, and commercial-use rights.",[636,650,661],{"id":637,"relate_table":638,"relate_id":639,"file_size":572,"file_name":640,"path":8,"duration":572,"cate":483,"file_format":641,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":642,"cate_name":643,"evidence":644,"question":645,"risk_level":646,"expert_answer":647,"recommendations":648,"security_analysis":649},15356,"union_cubo",1805363208,"样例_3.json","json","{\"evidence\": \"The app stores its refresh token in the Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. The Keychain item is not marked synchronizable. The app reads the item for background refresh after the device has been unlocked following startup. No additional Keychain access-control requirement is present in the reviewed item configuration.\", \"question\": \"Is the refresh-token Keychain configuration appropriate for an app that performs background refresh, and what trade-offs does it introduce?\", \"risk_level\": \"medium\", \"expert_answer\": \"This configuration is consistent with the stated need to read the token during background work after the first device unlock. The AfterFirstUnlock accessibility class permits access after the first unlock following a restart, including while the device is subsequently locked. The ThisDeviceOnly variant prevents the item from migrating to another device through backup or restoration, and the item is not configured for Keychain synchronization. The trade-off is that the token is available to the app after first unlock even when the device is locked; the evidence does not show an additional user-presence or biometric check. If background refresh does not require access while locked, a more restrictive accessibility class such as kSecAttrAccessibleWhenUnlockedThisDeviceOnly may be preferable. Otherwise, retain the current class only for the functionality that needs it and protect the token through limited scope, expiration, and server-side revocation.\", \"recommendations\": \"Confirm that background access while the device is locked is a documented requirement. If it is not, use a more restrictive accessibility class such as kSecAttrAccessibleWhenUnlockedThisDeviceOnly. Keep the token limited in scope and lifetime, revoke it on logout, and ensure the server can revoke it promptly. Review all token read and write paths and verify that no duplicate copies are written to logs, preferences, or other less-protected storage.\", \"security_analysis\": \"The evidence shows storage in the Keychain, device-bound behavior, and an accessibility choice that supports background access after first unlock. These properties limit migration and support the stated use case, but do not make the token inaccessible in every locked-device state. No additional access-control requirement is configured for the reviewed item. The evidence does not establish the token's permissions, lifetime, server-side revocation behavior, or whether other copies are stored elsewhere, so those aspects cannot be assessed from this configuration alone.\"}","文本","The app stores its refresh token in the Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. The Keychain item is not marked synchronizable. The app reads the item for background refresh after the device has been unlocked following startup. No additional Keychain access-control requirement is present in the reviewed item configuration.","Is the refresh-token Keychain configuration appropriate for an app that performs background refresh, and what trade-offs does it introduce?","medium","This configuration is consistent with the stated need to read the token during background work after the first device unlock. The AfterFirstUnlock accessibility class permits access after the first unlock following a restart, including while the device is subsequently locked. The ThisDeviceOnly variant prevents the item from migrating to another device through backup or restoration, and the item is not configured for Keychain synchronization. The trade-off is that the token is available to the app after first unlock even when the device is locked; the evidence does not show an additional user-presence or biometric check. If background refresh does not require access while locked, a more restrictive accessibility class such as kSecAttrAccessibleWhenUnlockedThisDeviceOnly may be preferable. Otherwise, retain the current class only for the functionality that needs it and protect the token through limited scope, expiration, and server-side revocation.","Confirm that background access while the device is locked is a documented requirement. If it is not, use a more restrictive accessibility class such as kSecAttrAccessibleWhenUnlockedThisDeviceOnly. Keep the token limited in scope and lifetime, revoke it on logout, and ensure the server can revoke it promptly. Review all token read and write paths and verify that no duplicate copies are written to logs, preferences, or other less-protected storage.","The evidence shows storage in the Keychain, device-bound behavior, and an accessibility choice that supports background access after first unlock. These properties limit migration and support the stated use case, but do not make the token inaccessible in every locked-device state. No additional access-control requirement is configured for the reviewed item. The evidence does not establish the token's permissions, lifetime, server-side revocation behavior, or whether other copies are stored elsewhere, so those aspects cannot be assessed from this configuration alone.",{"id":651,"relate_table":638,"relate_id":652,"file_size":572,"file_name":653,"path":8,"duration":572,"cate":483,"file_format":641,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":654,"cate_name":643,"evidence":655,"question":656,"risk_level":657,"expert_answer":658,"recommendations":659,"security_analysis":660},15355,1279603773,"样例_2.json","{\"evidence\": \"The app registers the custom URL scheme northstar-auth. Its reviewed callback handler reads an access_token query parameter and writes the complete callback URL to an info-level application log. The reviewed handler does not validate an OAuth state value before accepting the callback.\", \"question\": \"What are the security implications of handling an authentication callback through a custom URL scheme as described, and what changes should be made?\", \"risk_level\": \"high\", \"expert_answer\": \"The callback handling has several material weaknesses. A custom URL scheme is not an exclusive app identity, so another app may be able to register the same scheme; the evidence does not establish that another app has done so or that it can reliably intercept this callback. More directly, placing an access token in the URL and logging the complete callback creates additional exposure paths for a bearer credential. The reviewed handler also lacks state validation, weakening protection against unsolicited or mismatched authorization responses. Prefer an authorization-code flow with PKCE and validate a high-entropy state value bound to the initiating request. Do not place bearer tokens in callback URLs or log sensitive callback parameters. Where the flow supports it, use a properly configured Universal Link with an associated domain rather than relying solely on a custom scheme.\", \"recommendations\": \"Change the authorization flow to return a short-lived authorization code and exchange it using PKCE; validate state against the request that initiated the flow. Remove access tokens from URLs where possible, redact callback parameters from logs, and review existing logs for sensitive values. Consider Universal Links with correct domain association and validate the callback's expected scheme, host, path, and parameters. Revoke exposed tokens and reduce their lifetime and scope if the current implementation has been deployed.\", \"security_analysis\": \"The risk is high because the evidence shows that a bearer token is accepted from a callback URL and that the full URL is written to logs. Anyone who obtains that logged value may be able to use the token until it expires or is revoked. The absence of state validation also leaves the handler without an evidenced check that the response corresponds to the app's initiating authorization request. The evidence does not demonstrate that a token has been stolen, that another app has registered the scheme, or how long the token remains valid.\"}","The app registers the custom URL scheme northstar-auth. Its reviewed callback handler reads an access_token query parameter and writes the complete callback URL to an info-level application log. The reviewed handler does not validate an OAuth state value before accepting the callback.","What are the security implications of handling an authentication callback through a custom URL scheme as described, and what changes should be made?","high","The callback handling has several material weaknesses. A custom URL scheme is not an exclusive app identity, so another app may be able to register the same scheme; the evidence does not establish that another app has done so or that it can reliably intercept this callback. More directly, placing an access token in the URL and logging the complete callback creates additional exposure paths for a bearer credential. The reviewed handler also lacks state validation, weakening protection against unsolicited or mismatched authorization responses. Prefer an authorization-code flow with PKCE and validate a high-entropy state value bound to the initiating request. Do not place bearer tokens in callback URLs or log sensitive callback parameters. Where the flow supports it, use a properly configured Universal Link with an associated domain rather than relying solely on a custom scheme.","Change the authorization flow to return a short-lived authorization code and exchange it using PKCE; validate state against the request that initiated the flow. Remove access tokens from URLs where possible, redact callback parameters from logs, and review existing logs for sensitive values. Consider Universal Links with correct domain association and validate the callback's expected scheme, host, path, and parameters. Revoke exposed tokens and reduce their lifetime and scope if the current implementation has been deployed.","The risk is high because the evidence shows that a bearer token is accepted from a callback URL and that the full URL is written to logs. Anyone who obtains that logged value may be able to use the token until it expires or is revoked. The absence of state validation also leaves the handler without an evidenced check that the response corresponds to the app's initiating authorization request. The evidence does not demonstrate that a token has been stolen, that another app has registered the scheme, or how long the token remains valid.",{"id":662,"relate_table":638,"relate_id":663,"file_size":572,"file_name":664,"path":8,"duration":572,"cate":483,"file_format":641,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":665,"cate_name":643,"evidence":666,"question":667,"risk_level":646,"expert_answer":668,"recommendations":669,"security_analysis":670},15354,1773925143,"样例_1.json","{\"evidence\": \"The Info.plist contains NSAppTransportSecurity with NSAllowsArbitraryLoads set to true. Network tracing for the reviewed onboarding flow recorded a request to a cleartext HTTP endpoint. The trace does not show whether credentials or other sensitive data were included.\", \"question\": \"Does the app's App Transport Security configuration create a meaningful transport risk for the reviewed onboarding flow?\", \"risk_level\": \"medium\", \"expert_answer\": \"Yes. The broad NSAllowsArbitraryLoads setting relaxes App Transport Security protections for network connections, and the observed cleartext HTTP request confirms that at least one reviewed flow uses an unencrypted transport. HTTP does not provide transport confidentiality or integrity, so data in that request could be exposed to or altered by an on-path observer. The evidence does not establish what data was sent, whether other flows use HTTPS, or whether the endpoint is reachable in every app state. Migrate the endpoint and its callers to HTTPS, then remove the broad ATS exception. If a narrowly scoped exception is temporarily unavoidable, document its need and limit it to the specific domain and approved properties.\", \"recommendations\": \"Replace the cleartext endpoint with HTTPS and verify that the full onboarding flow, including redirects and secondary requests, remains on HTTPS. Remove NSAllowsArbitraryLoads where possible; avoid broad exceptions and use only narrowly scoped, documented exceptions if strictly necessary. Review request and response contents for sensitive data, and test ATS behavior on supported iOS versions.\", \"security_analysis\": \"The risk is supported by both the permissive ATS setting and the observed HTTP request. The setting alone would not prove that the app actually sends sensitive data over HTTP; the trace establishes cleartext use in the reviewed flow, but does not identify the request payload. The likely impact therefore depends on the data carried and the network context. No evidence here establishes exposure of credentials or compromise of another endpoint.\"}","The Info.plist contains NSAppTransportSecurity with NSAllowsArbitraryLoads set to true. Network tracing for the reviewed onboarding flow recorded a request to a cleartext HTTP endpoint. The trace does not show whether credentials or other sensitive data were included.","Does the app's App Transport Security configuration create a meaningful transport risk for the reviewed onboarding flow?","Yes. The broad NSAllowsArbitraryLoads setting relaxes App Transport Security protections for network connections, and the observed cleartext HTTP request confirms that at least one reviewed flow uses an unencrypted transport. HTTP does not provide transport confidentiality or integrity, so data in that request could be exposed to or altered by an on-path observer. The evidence does not establish what data was sent, whether other flows use HTTPS, or whether the endpoint is reachable in every app state. Migrate the endpoint and its callers to HTTPS, then remove the broad ATS exception. If a narrowly scoped exception is temporarily unavoidable, document its need and limit it to the specific domain and approved properties.","Replace the cleartext endpoint with HTTPS and verify that the full onboarding flow, including redirects and secondary requests, remains on HTTPS. Remove NSAllowsArbitraryLoads where possible; avoid broad exceptions and use only narrowly scoped, documented exceptions if strictly necessary. Review request and response contents for sensitive data, and test ATS behavior on supported iOS versions.","The risk is supported by both the permissive ATS setting and the observed HTTP request. The setting alone would not prove that the app actually sends sensitive data over HTTP; the trace establishes cleartext use in the reviewed flow, but does not identify the request payload. The likely impact therefore depends on the data carried and the network context. No evidence here establishes exposure of credentials or compromise of another endpoint.","{\"evidence\":\"The app stores its refresh token in the Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. The Keychain item is not marked synchronizable. The app reads the item for background refresh after the device has been unlocked following startup. No additional Keychain access-control requirement is present in the reviewed item configuration.\",\"question\":\"Is the refresh-token Keychain configuration appropriate for an app that performs background refresh, and what trade-offs does it introduce?\",\"risk_level\":\"medium\",\"expert_answer\":\"This configuration is consistent with the stated need to read the token during background work after the first device unlock. The AfterFirstUnlock accessibility class permits access after the first unlock following a restart, including while the device is subsequently locked. The ThisDeviceOnly variant prevents the item from migrating to another device through backup or restoration, and the item is not configured for Keychain synchronization. The trade-off is that the token is available to the app after first unlock even when the device is locked; the evidence does not show an additional user-presence or biometric check. If background refresh does not require access while locked, a more restrictive accessibility class such as kSecAttrAccessibleWhenUnlockedThisDeviceOnly may be preferable. Otherwise, retain the current class only for the functionality that needs it and protect the token through limited scope, expiration, and server-side revocation.\",\"recommendations\":\"Confirm that background access while the device is locked is a documented requirement. If it is not, use a more restrictive accessibility class such as kSecAttrAccessibleWhenUnlockedThisDeviceOnly. Keep the token limited in scope and lifetime, revoke it on logout, and ensure the server can revoke it promptly. Review all token read and write paths and verify that no duplicate copies are written to logs, preferences, or other less-protected storage.\",\"security_analysis\":\"The evidence shows storage in the Keychain, device-bound behavior, and an accessibility choice that supports background access after first unlock. These properties limit migration and support the stated use case, but do not make the token inaccessible in every locked-device state. No additional access-control requirement is configured for the reviewed item. The evidence does not establish the token's permissions, lifetime, server-side revocation behavior, or whether other copies are stored elsewhere, so those aspects cannot be assessed from this configuration alone.\"}","MOBIUSI INC","https:\u002F\u002Fstatic.mobiusi.com\u002Fmobiwusi\u002F20250829\u002F7bf4ac62b4533e2b809998a6f1c5491e.png?Expires=1792463130&OSSAccessKeyId=LTAI5tH8MQqhgeiAtrzCHrxM&Signature=v6Tr8jBrdm4s5wU1SnnyGsYg%2Bhw%3D&x-oss-process=image%2Fresize%2Cm_fill%2Cw_35%2Ch_35",[675,681],{"type":676,"title":677,"count_data":678},"bar","Length distribution",[679],{"name":680,"value":483},"1k lower",{"type":682,"title":683,"count_data":684},"pie","Language distribution",[685],{"name":686,"value":483},"English"]