deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0051

---
platform: android
title: Identifying Insecure Dependencies through SBOM Creation
id: MASTG-DEMO-0051
test: MASTG-TEST-0272
---

## Steps

Execute `cdxgen` in the root directory of the Android Studio project.

{{ run.sh }}

This will create a SBOM file that can be uploaded to @MASTG-TOOL-0132 by following @MASTG-TECH-0130.

## Observation

In the project of @MASTG-TOOL-0132, where the SBOM has been uploaded, the scan should have identified over 200 unique dependencies (components) with 7 vulnerable dependencies and 7 vulnerabilities (as more vulnerabilities might be found over time this number might increase).

{{ sbom.json }}

## Evaluation

Review each of the reported instances. The dependency `okhttp` has 2 known vulnerabilities and `okio` has 1 known vulnerability and they should all be updated to the latest version.

{{ output.json }}
OWASP Mobile Application Security Testing Guide: output

                  
                  
┌────────────────┐
│ 1 Code Finding │
└────────────────┘
                           
    MastgTest_reversed.java
    ❯❱rules.mastg-android-object-deserialization
          [MASVS-CODE-4] The application makes use of Object deserialization in the code using the ObjectInputStream.readObject() function call.
                                                                                         
          107┆ ObjectInputStream ois = new ObjectInputStream(new
               ByteArrayInputStream(serializedPayload));        
          108┆ Object untrustedObject = ois.readObject();
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0043

---
platform: ios
title: Uses of kSecAccessControlUserPresence with r2
id: MASTG-DEMO-0043
code: [swift]
test: MASTG-TEST-0268
---

## Sample

The following sample correctly uses the Keychain API for local authentication (`SecAccessControlCreateWithFlags`) but it uses the [`kSecAccessControlUserPresence`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/userpresence) flag which allows fallback to device passcode when biometric authentication fails or isn't yet configured.

{{ MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run `run.sh`.

{{ biometricAuthenticationFallback.r2 }}

{{ run.sh }}

## Observation

{{ output.asm }}

The output reveals the use of `SecAccessControlCreateWithFlags(allocator, protection, flags, error)` in the app. In this demo, we focus on the `flags` argument because it specifies the [Access Control](https://developer.apple.com/documentation/security/secaccesscontrol). `flags` is a third argument of the function, so it's at `x2/w2` register. By looking at the output, we can see that `w2` register holds value of `1`.

```assembly
mov w2, 1
bl sym.imp.SecAccessControlCreateWithFlags
```

The `flags` is an enum of [`SecAccessControlCreateFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags). `1` corresponds with `kSecAccessControlUserPresence` (see [LAPublicDefines.h](https://github.com/xybp888/iOS-SDKs/blob/master/iPhoneOS18.4.sdk/System/Library/Frameworks/LocalAuthentication.framework/Headers/LAPublicDefines.h#L12-L18)). This means that the app invokes `SecAccessControlCreateWithFlags(..., kSecAccessControlUserPresence)`, which means it falls back to device's passcode authentication.

## Evaluation

The test fails because the output shows references to biometric verification that falls back to device's passcode authentication, specifically `kSecAccessControlUserPresence`.

Since this data requires protection with biometrics, it's recommended to use the [`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) or [`kSecAccessControlBiometryAny`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometryany) flags instead, being `kSecAccessControlBiometryCurrentSet` the most secure.
OWASP Mobile Application Security Testing Guide: output

SecAccessControlCreateWithFlags(..., 0x2) called with kSecAccessControlBiometryAny

Backtrace:
0x102350198 MASTestApp!specialized static MastgTest.createAccessControl()
0x1023504b0 MASTestApp!specialized static MastgTest.storeTokenInKeychain(secretToken:)
0x102351b98 MASTestApp!closure #1 in closure #1 in closure #1 in ContentView.body.getter
0x19908bc54 SwiftUI!partial apply for closure #1 in closure #2 in ContextMenuBridge.contextMenuInteraction(_:willPerformPreviewActionForMenuWith:animator:)
0x198f986d0 SwiftUI!partial apply for specialized thunk for @callee_guaranteed () -> (@out A, @error @owned Error)
0x1996657c4 SwiftUI!specialized static MainActor.assumeIsolated<A>(_:file:line:)
0x1996321a8 SwiftUI!ButtonAction.callAsFunction()
0x198b14c2c SwiftUI!partial apply for implicit closure #2 in implicit closure #1 in PlatformItemListButtonStyle.makeBody(configuration:)
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0046

---
platform: ios
title: Runtime Use of kSecAccessControlBiometryCurrentSet with Frida
id: MASTG-DEMO-0046
code: [swift]
test: MASTG-TEST-0271
---

## Sample

This demo uses the same sample as @MASTG-DEMO-0045.

{{ ../MASTG-DEMO-0045/MastgTest.swift }}

## Steps

1. Install the app on a device (@MASTG-TECH-0056)
2. Make sure you have @MASTG-TOOL-0039 installed on your machine and the frida-server running on the device
3. Run `run.sh` to spawn your app with Frida
4. Click the **Start** button
5. Stop the script by pressing `Ctrl+C`

{{ run.sh # ../MASTG-DEMO-0044/script.js }}

## Observation

{{ output.txt }}

The output reveals the use of `SecAccessControlCreateWithFlags` in the app and lists all used flags.

## Evaluation

The test fails because the output shows the runtime use of `SecAccessControlCreateWithFlags` with `kSecAccessControlBiometryAny` (see [LAPublicDefines.h](https://github.com/xybp888/iOS-SDKs/blob/master/iPhoneOS18.4.sdk/System/Library/Frameworks/LocalAuthentication.framework/Headers/LAPublicDefines.h#L12-L18)), which accepts any additional biometrics added after the Keychain entry was created.

When it is required that the associated keychain item become inaccessible when changes are made to the biometric database (e.g., when a new fingerprint or face is added), the app must use the[`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) flag instead.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0047

---
platform: ios
title: Runtime Use of the Keychain Not Requiring User Presence with Frida
id: MASTG-DEMO-0047
code: [swift]
test: MASTG-TEST-0266
kind: fail
status: placeholder
note: This demo shows how to store sensitive data insecurely in the Keychain by not requiring user presence (e.g., biometrics).
---
OWASP Mobile Application Security Testing Guide: output

SecAccessControlCreateWithFlags(..., 0x1) called with kSecAccessControlUserPresence

Backtrace:
0x100a4c27c MASTestApp.debug.dylib!static MastgTest.mastgTest(completion:)
0x100a4f000 MASTestApp.debug.dylib!$s10MASTestApp11ContentViewV4bodyQrvg7SwiftUI05TupleD0VyAE0D0PAEE7paddingyQrAE4EdgeO3SetV_12CoreGraphics7CGFloatVSgtFQOyAE6HStackVyAGyAE4TextV_AE6SpacerVAiEEAJyQrAN_ARtFQOyAiEE12cornerRadius_11antialiasedQrAQ_SbtFQOyAiEE10background_9alignmentQrqd___AE9AlignmentVtAeHRd__lFQOyAE6ButtonVyAiEE4fontyQrAE4FontVSgFQOyAiEEAJyQrAN_ARtFQOyAiEEAJyQrAN_ARtFQOyAV_Qo__Qo__Qo_G_AE14LinearGradientVQo__Qo__Qo_tGG_Qo__AiEEAJyQrAN_ARtFQOyAiEEAY_AZQrAQ_SbtFQOyAiEEA__A0_Qrqd___A2_tAeHRd__lFQOyAiEE5frame8minWidth10idealWidth8maxWidth9minHeight11idealHeight9maxHeightA0_QrAR_A5RA2_tFQOyAE06ScrollD0VyAiEEAJyQrAN_ARtFQOyAiEEA21_A22_A23_A24_A25_A26_A27_A0_QrAR_A5RA2_tFQOyAV_Qo__Qo_G_Qo__AE5ColorVQo__Qo__Qo_AiEEAJyQrAN_ARtFQOyAiEEAJyQrAN_ARtFQOyAiEE14textFieldStyleyQrqd__AE0P10FieldStyleRd__lFQOyAE0P5FieldVyAVG_AE013RoundedBorderP10FieldStyleVQo__Qo__Qo_tGyXEfU_A18_yXEfU_yyScMYccfU_
0x19ffdae30 SwiftUI!partial apply for implicit closure #2 in implicit closure #1 in WrappedButtonStyle.Body.body.getter
0x1a02f1f28 SwiftUI!closure #1 in PressableGestureCallbacks.dispatch(phase:state:)
0x1a005bb98 SwiftUI!thunk for @escaping @callee_guaranteed () -> ()
0x1a005bbc0 SwiftUI!thunk for @escaping @callee_guaranteed () -> (@out ())
0x1a005bb98 SwiftUI!thunk for @escaping @callee_guaranteed () -> ()
0x1a004a764 SwiftUI!static Update.end()
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0044

---
platform: ios
title: Runtime Use of kSecAccessControlUserPresence with Frida
id: MASTG-DEMO-0044
code: [swift]
test: MASTG-TEST-0269
---

## Sample

This demo uses the same sample as @MASTG-DEMO-0043.

{{ ../MASTG-DEMO-0043/MastgTest.swift }}

## Steps

1. Install the app on a device (@MASTG-TECH-0056)
2. Make sure you have @MASTG-TOOL-0039 installed on your machine and the frida-server running on the device
3. Run `run.sh` to spawn your app with Frida
4. Click the **Start** button
5. Stop the script by pressing `Ctrl+C`

{{ run.sh # script.js }}

## Observation

{{ output.txt }}

The output reveals the use of `SecAccessControlCreateWithFlags` in the app and lists all used flags.

## Evaluation

The test fails because the output shows the runtime use of `SecAccessControlCreateWithFlags(..., kSecAccessControlUserPresence)` which allows for a fallback to passcode authentication.

Since this data requires protection with biometrics, It's recommended to use the [`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) or [`kSecAccessControlBiometryAny`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometryany) flags instead, being `kSecAccessControlBiometryCurrentSet` the most secure.
OWASP Mobile Application Security Testing Guide: output


LAContext.canEvaluatePolicy(0x1) called with .deviceOwnerAuthenticationWithBiometrics (0x1)


Backtrace:
0x10095c35c MASTestApp!specialized static MastgTest.mastgTest(completion:)
0x10095d4b4 MASTestApp!closure #1 in closure #1 in closure #1 in ContentView.body.getter
0x19f6cbc54 SwiftUI!partial apply for closure #1 in closure #2 in ContextMenuBridge.contextMenuInteraction(_:willPerformPreviewActionForMenuWith:animator:)
0x19f5d86d0 SwiftUI!partial apply for specialized thunk for @callee_guaranteed () -> (@out A, @error @owned Error)
0x19fca57c4 SwiftUI!specialized static MainActor.assumeIsolated<A>(_:file:line:)
0x19fc721a8 SwiftUI!ButtonAction.callAsFunction()
0x19f154c2c SwiftUI!partial apply for implicit closure #2 in implicit closure #1 in PlatformItemListButtonStyle.makeBody(configuration:)
0x19f6813b4 SwiftUI!ButtonBehavior.ended()
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0042

---
platform: ios
title: Runtime Use of LAContext.evaluatePolicy with Frida
id: MASTG-DEMO-0042
code: [swift]
test: MASTG-TEST-0267
---

## Sample

This demo uses the same sample as @MASTG-DEMO-0041.

{{ ../MASTG-DEMO-0041/MastgTest.swift }}

## Steps

1. Install the app on a device (@MASTG-TECH-0056)
2. Make sure you have @MASTG-TOOL-0039 installed on your machine and the frida-server running on the device
3. Run `run.sh` to spawn your app with Frida
4. Click the **Start** button
5. Stop the script by pressing `Ctrl+C`

{{ run.sh # script.js }}

## Observation

{{ output.txt }}

The output reveals the use of `LAContext.evaluatePolicy(0x1, ...)` in the app. Policy `0x1` is [`.deviceOwnerAuthenticationWithBiometrics`](https://developer.apple.com/documentation/localauthentication/lapolicy/deviceownerauthenticationwithbiometrics).

## Evaluation

The test fails because the output only shows calls to biometric verification with LocalAuthentication API and no calls to any Keychain APIs requiring user presence (`SecAccessControlCreateWithFlags`).
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0045

---
platform: ios
title: Uses of kSecAccessControlBiometryCurrentSet with r2
id: MASTG-DEMO-0045
code: [swift]
test: MASTG-TEST-0270
---

## Sample

The following sample uses the `kSecAccessControlBiometryAny` flag, which is part of the biometric authentication API and can allow unauthorized access. This flag does not ensure that the associated keychain item becomes inaccessible when changes are made to the biometric database (e.g., when a new fingerprint or face is added). Consequently, users who enroll their biometric data after the item is created can unlock it.

{{ MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run `run.sh`.

{{ biometricAuthenticationEnrollmentChange.r2 }}

{{ run.sh }}

## Observation

{{ output.asm }}

The output reveals the use of `SecAccessControlCreateWithFlags(allocator, protection, flags, error)` in the app. In this demo, we focus on the `flags` argument because it specifies the [Access Control](https://developer.apple.com/documentation/security/secaccesscontrol). `flags` is the third argument of the function, so it's at `x2/w2` register. By looking at the output, we can see that `w2` register holds value of `2`.

```assembly
mov w2, 2
bl sym.imp.SecAccessControlCreateWithFlags
```

The `flags` is an enum of [`SecAccessControlCreateFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags). `2` corresponds to [`kSecAccessControlBiometryAny`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometryany) (see [LAPublicDefines.h](https://github.com/xybp888/iOS-SDKs/blob/master/iPhoneOS18.4.sdk/System/Library/Frameworks/LocalAuthentication.framework/Headers/LAPublicDefines.h#L12-L18)). This means that the app invokes `SecAccessControlCreateWithFlags(..., kSecAccessControlBiometryAny)`, which means it will accept new biometric added in the system settings.

## Evaluation

The test fails because the output shows a reference to `SecAccessControlCreateWithFlags` with `kSecAccessControlBiometryAny`, which accepts any additional biometrics added after the Keychain entry was created.

When it is required that the associated keychain item become inaccessible when changes are made to the biometric database (e.g., when a new fingerprint or face is added), the app must use the[`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) flag instead.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0065

---
platform: ios
title: Uses of Logging APIs with r2
code: [swift]
id: MASTG-DEMO-0065
test: MASTG-TEST-0297
---

## Sample

The code snippet below shows sample code that insecurely logs a sensitive token:

{{ MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run `run.sh` to find all occurrences of `NSLog`.
3. Update `loggingApis.r2` to also detect other logging APIs, such as `print`.

{{ loggingApis.r2 }}

{{ run.sh }}

## Observation

The output contains the location of `NSLog` usage in the binary.

{{ output.asm # function.asm }}

Reading `output.asm` doesn't clearly show what arguments are passed to `NSLog`, so you can also make use of `function.asm` for a better overview.

## Evaluation

The test fails because the app calls `NSLog` with a secret token as an argument.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0019

---
platform: ios
title: Uses of isExcludedFromBackupKey with r2
code: [swift]
id: MASTG-DEMO-0019
test: MASTG-TEST-0215
---

## Sample

The code snippet below shows sample code that creates a file and marks it with `isExcludedFromBackupKey`.

{{ MastgTest.swift # function.asm # decompiled-o1-review.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run `run.sh`.

{{ isExcludedFromBackup.r2 }}

{{ run.sh }}

## Observation

The output reveals the use of `isExcludedFromBackupKey` in the app.

{{ output.asm }}

## Evaluation

The test fails because `secret.txt` might be restored from the backup and it contains sensitive data.

You can see the call to `isExcludedFromBackupKey` at `0x100004594` and the associated file, `secret.txt` at `0x10000443c`.

!!! note
    Using artificial intelligence we're able to decompile the disassembled code and review it. The output is a human-readable version of the assembly code. The AI decompiled code may not perfect and might contain errors but, in this case, it clearly shows the use of `isExcludedFromBackupKey` and the associated file `secret.txt`.
OWASP Mobile Application Security Testing Guide: output

Eligible for caching [autocorrectionType=.default, spellCheckingType=.no, isSecureTextEntry=false, class=_UIAlertControllerTextField, aid=name_field, placeholder=Name]: "OWASP MAS"
Eligible for caching [autocorrectionType=.no, spellCheckingType=.default, isSecureTextEntry=false, class=_UIAlertControllerTextField, aid=email_field, placeholder=E-Mail]: "mas@owasp.org"
Excluded from caching [autocorrectionType=.no, spellCheckingType=.no, isSecureTextEntry=true, class=_UIAlertControllerTextField, aid=password_field, placeholder=Password]: "my$ecr3tP4sS!"
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0077

---
platform: ios
title: Runtime Monitoring of Text Fields Eligible for Keyboard Caching with Frida
id: MASTG-DEMO-0077
code: [swift]
test: MASTG-TEST-0314
---

## Sample

This demo uses the same sample as @MASTG-DEMO-0076.

{{ ../MASTG-DEMO-0076/MastgTest.swift }}

## Steps

1. Install the app on a device (@MASTG-TECH-0056).
2. Make sure you have @MASTG-TOOL-0039 installed on your machine and the frida-server running on the device.
3. Run `run.sh` to spawn your app with Frida.
4. Click the **Start** button.
5. Stop the script by pressing `Ctrl+C`.

{{ run.sh # script.js }}

The script hooks into text input controls at runtime and monitors when they lose focus. For each interaction, it captures the entered text, the input field class, accessibility identifier when available, placeholder text when available, and the relevant input traits such as `autocorrectionType`, `spellCheckingType`, and `isSecureTextEntry`. Based on these values, it reports whether the input is eligible for keyboard caching.

## Observation

{{ output.txt }}

The output contains all text that the user entered in every text input, along with its keyboard-cache eligibility.

## Evaluation

The test fails because the output shows two text fields that are eligible for keyboard caching and contain sensitive information: the user's name and email address.

- The name input has `autocorrectionType` set to `default`, making it eligible for keyboard caching.
- The email input has `autocorrectionType` set to `no` but `spellCheckingType` set to `default`, making it eligible for keyboard caching.

The password input is protected against keyboard caching because `isSecureTextEntry` is set to `true`.
OWASP Mobile Application Security Testing Guide: output

[connected]
Sep 22 11:20:30 MASTestApp(UIKitCore)[32240] <Notice>: TX focusApplication (peekAppEvent) stealKB:Y scene:com.ja5er.test3-A8E224F1-CF5E-4699-9F77-10EACB955D4E
Sep 22 11:20:30 MASTestApp(UIKitCore)[32240] <Notice>: Evaluating dispatch of UIEvent: 0x103528fc0; type: 0; subtype: 0; backing type: 11; shouldSend: 1; ignoreInteractionEvents: 0, systemGestureStateChange: 0
Sep 22 11:20:30 MASTestApp(UIKitCore)[32240] <Notice>: Sending UIEvent type: 0; subtype: 0; to windows: 1
Sep 22 11:20:30 MASTestApp(UIKitCore)[32240] <Notice>: Sending UIEvent type: 0; subtype: 0; to window: <UIWindow: 0x1029c3e10>; contextId: 0x63D3A5C4
Sep 22 11:20:30 MASTestApp(UIKitCore)[32240] <Notice>: Evaluating dispatch of UIEvent: 0x103528fc0; type: 0; subtype: 0; backing type: 11; shouldSend: 0; ignoreInteractionEvents: 0, systemGestureStateChange: 0
Sep 22 11:20:31 MASTestApp(UIKitCore)[32240] <Notice>: Evaluating dispatch of UIEvent: 0x103528fc0; type: 0; subtype: 0; backing type: 11; shouldSend: 0; ignoreInteractionEvents: 0, systemGestureStateChange: 1
Sep 22 11:20:31 MASTestApp(UIKitCore)[32240] <Notice>: Evaluating dispatch of UIEvent: 0x103528fc0; type: 0; subtype: 0; backing type: 11; shouldSend: 1; ignoreInteractionEvents: 0, systemGestureStateChange: 0
Sep 22 11:20:31 MASTestApp(UIKitCore)[32240] <Notice>: Sending UIEvent type: 0; subtype: 0; to windows: 1
Sep 22 11:20:31 MASTestApp(UIKitCore)[32240] <Notice>: Sending UIEvent type: 0; subtype: 0; to window: <UIWindow: 0x1029c3e10>; contextId: 0x63D3A5C4
Sep 22 11:20:31 MASTestApp(Foundation)[32240] <Notice>: NSLog: Leaking TOKEN=123 from NSLog
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning: Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning (privacy: .public): Leaking TOKEN=123
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning (privacy: .private): Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning (privacy: .sensitive): Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.error: Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.error (privacy: .public): Leaking TOKEN=123
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.error (privacy: .private): Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.error (privacy: .sensitive): Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Fault>: logger.fault: Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Fault>: logger.fault (privacy: .public): Leaking TOKEN=123
Sep 22 11:20:31 MASTestApp[32240] <Fault>: logger.fault (privacy: .private): Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Fault>: logger.fault (privacy: .sensitive): Leaking <private>
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0066

---
platform: ios
title: Sensitive Data Logging with idevicesyslog
code: [swift]
id: MASTG-DEMO-0066
test: MASTG-TEST-0296
---

## Sample

The code snippet below shows sample code that logs a sensitive token:

{{ ../MASTG-DEMO-0065/MastgTest.swift }}

## Steps

1. Install the app on a device (@MASTG-TECH-0056).
2. Make sure you have @MASTG-TOOL-0126 installed on your machine.
3. Run `run.sh` to start the log capturing.
4. Click the **Start** button.
5. Stop the script by pressing `Ctrl+C` to end the log capturing.

{{ run.sh }}

## Observation

The output contains all device logs, including the logged strings from the app.

{{ output.txt }}

## Evaluation

The test fails because we can see `TOKEN=123` in the logs:

```text
Sep 22 11:20:31 MASTestApp(Foundation)[32240] <Notice>: NSLog: Leaking TOKEN=123 from NSLog
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning: Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning (privacy: .public): Leaking TOKEN=123
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.error (privacy: .public): Leaking TOKEN=123
Sep 22 11:20:31 MASTestApp[32240] <Fault>: logger.fault (privacy: .public): Leaking TOKEN=123
```

Note how some of the logs pass the test since they were **properly** redacted with `<private>`. For example:

```text
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning (privacy: .private): Leaking <private>
Sep 22 11:20:31 MASTestApp[32240] <Error>: logger.warning (privacy: .sensitive): Leaking <private>
```