Static IV (ARCH9114)

Key swift.security.static-iv · Severity error · Category security · CWE CWE-329

Flags IVs / nonces built from string literals or zero-filled arrays.

Incorrect

let iv = [UInt8](repeating: 0, count: 16)

Correct

let nonce = AES.GCM.Nonce()

Fix

Generate a random nonce per encryption and store it with the ciphertext.