Keychain Inspection & Attacks

The keychain is where iOS apps are supposed to put secrets — and on a test device you own, with the app unlocked, you can read them straight back out. But the keychain is not a black box; an item carries an accessibility class that decides WHEN it decrypts and an access group that decides WHO can read it. This walks the anatomy of an item, dumping with objection and keychain-dumper, why entitlements are the real boundary, and what is actually a finding.