Insecure Deserialization (ARCH9109)

Key swift.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Flags NSKeyedUnarchiver.unarchiveObject(with:) / unarchiveTopLevelObjectWithData and requiresSecureCoding = false.

Incorrect

let obj = NSKeyedUnarchiver.unarchiveObject(with: data)

Correct

let obj = try NSKeyedUnarchiver.unarchivedObject(ofClass: Payload.self, from: data)

Fix

Use the secure-coding API with an explicit class allowlist, or Codable.