iOS extensions do not run under the same conditions as the main application. Review data access, key sharing and security-SDK coverage for each extension.
Evaluation approach
Assess API suitability, startup overhead and shared resources in the extension environment. Explicitly verify the protection product's target support.
Application example
If a share extension receives a sensitive document, test its validation and storage controls as a separate flow.
Limits and considerations
A clean report for the main application does not establish an extension's security coverage.
A smaller process with different boundaries
Application extensions have their own execution and resource constraints. A security SDK designed for the main application may not work identically in every extension. Verify supported targets against vendor documentation.
Check the origin and validity of data an extension passes to the main application or shared storage. Decide in advance what happens when background or time constraints prevent a check from completing. Treating an incomplete check as successful can create a silent trust gap.
Checks and decisions
- List targets separately
- Check API suitability
- Test data flows
Do not automatically generalize a successful main-application check to an extension.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.