sensitive data on screenshots 3. Disallow typical passwords 4. Use TouchID/FaceID & 2FA 5. SFAuthenticationSession 6. Test your login flow 7. Automate checking code for forgotten secrets cfpb/clouseau 8. Avoid publish keys (use .gitignore properly) 9. Well-configure SSL 10. Third party code - check it before using