App Store Reject

Guideline 1.6

Guideline 1.6 - Safety: Insecure Data Handling

Medium SeverityMedium FixTypical Fix: 2-8 hours0 Reports
Also known as:App transmits user data over an unencrypted HTTP connectionApp stores passwords or sensitive data in plain textApp Transport Security exceptions used without justificationApp includes SDK with known security vulnerabilitiesSensitive user information not properly protected

Our Take

Apple is rejecting your app because it doesn't implement appropriate security measures for handling user information. This covers transmitting sensitive data over unencrypted connections (HTTP instead of HTTPS), storing credentials in plain text, lacking App Transport Security compliance, or having known security vulnerabilities. This rejection is less common as a standalone reason (most apps use HTTPS by default now), but it still appears when apps communicate with legacy backend services over HTTP, store sensitive data in UserDefaults or plain-text files, or include SDKs with known vulnerabilities. App Transport Security (ATS) is enforced by default in iOS — if your app needs to communicate over HTTP, you must add ATS exceptions in your Info.plist, and Apple may question those exceptions during review.

Resolution Guide

01

Migrate to HTTPS

Ensure all network requests use HTTPS. Update any hardcoded HTTP URLs to HTTPS. If your backend doesn't support HTTPS, that's the first priority.

02

Remove ATS exceptions

Review your Info.plist for NSAllowsArbitraryLoads or domain-specific ATS exceptions. Remove any that aren't absolutely necessary and document the remaining ones in Review Notes.

03

Secure stored data

Move sensitive data from UserDefaults, plain-text files, or SQLite to the iOS Keychain. Use encryption for any local data storage containing PII.

04

Update vulnerable SDKs

Check for known vulnerabilities in your dependencies and update to patched versions.

05

Audit data handling

Review all points where user data is collected, transmitted, or stored. Ensure each point uses appropriate security measures.

Prevention

  • Use HTTPS everywhere with no exceptions
  • Store sensitive data in the iOS Keychain, not UserDefaults
  • Keep all SDKs and dependencies up to date
  • Run security audits before submission

    • Example Rejection Email

    From:Apple App Review Team
    Subject:Guideline 1.6 - Safety: Insecure Data Handling
    Guideline 1.6 - Safety - Data Security Your app does not implement appropriate security measures to ensure the proper handling of user information. Specifically, your app [transmits user data over an unencrypted connection / stores sensitive information insecurely / includes known security vulnerabilities]. Next Steps: Please implement appropriate security measures to protect user data, including using HTTPS for all network communications and securing stored user information.

    Before & After

    Before — Rejected

    App sends login credentials to backend API over HTTP and stores auth token in UserDefaults

    After — Approved

    All API calls use HTTPS with certificate pinning, auth token stored in iOS Keychain, ATS exceptions removed from Info.plist

    What changed: All user data must be transmitted over encrypted connections and stored using secure platform APIs.

    Community Solutions · 0

    Sign in to share your solution.

    More Guideline 1 (Safety) rejections

    View all Guideline 1 rejections