Rules Hub
Coding Rules Library
← Back to all rules
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
mobile ruleP0universalStack: mobile
mobilesecuritysecretskeychain
Never hardcode secrets/API keys in the app binary
Anything compiled into a mobile app can be extracted; keep secrets server-side and store tokens in the Keychain/Keystore.
PR: mobile-canon-2026-06Created: Jul 5, 2026
Bad example
Old codeswift
| 1 | let apiKey = "sk_live_abc123" |
Explanation (EN)
Objašnjenje (HR)
Good example
New codeswift
| 1 | // fetch short-lived token from backend; store in Keychain |
Explanation (EN)
Objašnjenje (HR)