A notification extension runs outside the main application's execution context. Review its data, keys and endpoints separately.
Evaluation approach
Minimize personal payloads and restrict shared Keychain or App Group access to the extension's task.
Application example
Define what message details may appear on the lock screen. Test notifications received after logout.
Limits and considerations
Do not assume the main application's SDK protects all extensions equally.
What appears after a timeout?
Provide a safe fallback if content processing fails. Ensure raw sensitive payloads do not appear because of an error, and queued notifications do not expose a previous account after logout.
Checks and decisions
- Verify extension coverage
- Test lock screens
- Test post-logout events
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.