Arno-MHL/ios-security-vulnerabilities-swift-objc

iOS Security Vulnerabilities Dataset (Swift & Objective-C)

A comprehensive dataset of 27 real-world iOS security vulnerability patterns in Swift and Objective-C, covering all OWASP Mobile Top 10 (2024) categories with vulnerable code, secure fixes, attack scenarios, and detection guidance.

🎯 Purpose

This is the first dedicated iOS/Swift/Objective-C security vulnerability dataset on Hugging Face. While existing datasets (TitanVul, DiverseVul, CleanVul) focus on C/C++/Java/Python, none cover iOS-specific security patterns. This dataset fills that gap.

Use cases:

• —🤖 Train LLMs to detect iOS security vulnerabilities
• —📚 Security training and education for iOS developers
• —🔍 Build static analysis rules for Swift/Objective-C
• —🛡️ Benchmark code security models on mobile-specific patterns
• —💡 Reference guide for iOS security best practices

📊 Dataset Statistics

📋 Schema

Each example contains:

🔐 Vulnerability Categories Covered

OWASP Mobile Top 10 (2024) Coverage

iOS-Specific APIs Covered

• —Keychain Services — proper vs improper accessibility settings
• —UserDefaults/NSUserDefaults — plaintext storage of secrets
• —URLSession/NSURLSession — SSL pinning, certificate validation
• —WKWebView — XSS, JavaScript bridges, navigation control
• —LocalAuthentication — biometric auth bypass via passcode fallback
• —CommonCrypto — MD5, ECB mode, PBKDF2
• —CryptoKit — AES-GCM, SymmetricKey, SecureRandom
• —Core Data — encrypted storage, file protection
• —FileManager — backup exclusion, secure file paths
• —App Transport Security — proper ATS configuration
• —GCD/Dispatch — thread safety with barriers
• —UIPasteboard — clipboard expiration and local-only mode

🚀 Quick Start

from datasets import load_dataset

# Load the dataset
ds = load_dataset("Arno-MHL/ios-security-vulnerabilities-swift-objc")

# Browse examples
for example in ds["train"]:
    print(f"[{example['severity']}] {example['cwe_id']}: {example['cwe_name']}")
    print(f"  Language: {example['language']}")
    print(f"  OWASP: {example['owasp_mobile']}")
    print(f"  API Misused: {example['ios_api_misused']}")
    print()

# Filter by severity
critical = ds["train"].filter(lambda x: x["severity"] == "CRITICAL")
print(f"Critical vulnerabilities: {len(critical)}")

# Filter by language
swift_only = ds["train"].filter(lambda x: x["language"] == "swift")
objc_only = ds["train"].filter(lambda x: x["language"] == "objective-c")

# Get all CWE-312 (cleartext storage) examples
cleartext = ds["train"].filter(lambda x: x["cwe_id"] == "CWE-312")

📖 Example Entry

{
  "id": "ios-m9-001",
  "language": "swift",
  "cwe_id": "CWE-312",
  "cwe_name": "Cleartext Storage of Sensitive Information",
  "owasp_mobile": "M9: Insecure Data Storage",
  "severity": "HIGH",
  "ios_framework": "Foundation",
  "ios_api_misused": "UserDefaults",
  "vulnerability_description": "Storing user authentication tokens in UserDefaults without encryption...",
  "vulnerable_code": "// Full Swift code showing insecure UserDefaults usage...",
  "secure_code": "// Full Swift code showing proper Keychain Services usage...",
  "attack_scenario": "An attacker extracts an iTunes backup and reads the plist...",
  "fix_description": "Use iOS Keychain Services with kSecAttrAccessibleWhenUnlockedThisDeviceOnly...",
  "detection_hints": "Look for UserDefaults.standard.set() calls with sensitive key names...",
  "references": "OWASP Mobile Top 10 2024 M9, CWE-312"
}

🏗️ Methodology

This dataset was constructed following patterns from leading vulnerability dataset research:

• —Schema design: Based on SecureCode-web (arXiv:2512.18542)
• —Vulnerability taxonomy: OWASP Mobile Top 10 (2024) mapped to iOS-specific CWEs
• —Code patterns: Real-world vulnerability patterns documented in iOS security research, CVE databases, and Apple security guidelines
• —Quality assurance: Each example includes complete, compilable code (not snippets), realistic attack scenarios, and platform-specific remediation

📄 License

MIT License

📚 References

• —OWASP Mobile Top 10 (2024)
• —Apple Security Documentation
• —CWE - Common Weakness Enumeration
• —TitanVul Dataset
• —SecureCode v2.0

✏️ Citation

@dataset{ios_security_vulnerabilities_2025,
  title={iOS Security Vulnerabilities Dataset (Swift & Objective-C)},
  author={Arno-MHL},
  year={2025},
  url={https://huggingface.co/datasets/Arno-MHL/ios-security-vulnerabilities-swift-objc}
}