fix(security): enable secureTextEntry on card number and CVV fields

accept-sample-objc/Base.lproj/Main.storyboard

@@ -114,13 +114,13 @@
                                 <color key="textColor" red="0.0" green="0.0" blue="0.0" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
                                 <nil key="highlightedColor"/>
                             </label>
-                            <textField opaque="NO" clipsSubviews="YES" contentMode="scaleToFill" contentHorizontalAlignment="left" contentVerticalAlignment="center" borderStyle="line" placeholder="Card Number" textAlignment="center" minimumFontSize="17" translatesAutoresizingMaskIntoConstraints="NO" id="eHU-2A-J2n">
+                            <textField opaque="NO" clipsSubviews="YES" contentMode="scaleToFill" contentHorizontalAlignment="left" contentVerticalAlignment="center" borderStyle="line" placeholder="Card Number" textAlignment="center" minimumFontSize="17" secureTextEntry="YES" translatesAutoresizingMaskIntoConstraints="NO" id="eHU-2A-J2n">
                                 <rect key="frame" x="16" y="105" width="343" height="40"/>
                                 <constraints>
                                     <constraint firstAttribute="height" constant="40" id="oKQ-2d-BQe"/>
                                 </constraints>
                                 <fontDescription key="fontDescription" type="system" pointSize="15"/>
-                                <textInputTraits key="textInputTraits" keyboardType="numberPad" enablesReturnKeyAutomatically="YES"/>
+                                <textInputTraits key="textInputTraits" autocapitalizationType="none" autocorrectionType="no" spellCheckingType="no" keyboardType="numberPad" enablesReturnKeyAutomatically="YES"/>
                                 <variation key="default">
                                     <mask key="constraints">
                                         <exclude reference="oKQ-2d-BQe"/>
@@ -199,7 +199,7 @@
                                     <outlet property="delegate" destination="BYZ-38-t0r" id="jik-Pa-1GY"/>
                                 </connections>
                             </textField>
-                            <textField opaque="NO" clipsSubviews="YES" contentMode="scaleToFill" contentHorizontalAlignment="left" contentVerticalAlignment="center" borderStyle="line" placeholder="CVV" textAlignment="center" minimumFontSize="17" translatesAutoresizingMaskIntoConstraints="NO" id="Kvi-FO-XlV">
+                            <textField opaque="NO" clipsSubviews="YES" contentMode="scaleToFill" contentHorizontalAlignment="left" contentVerticalAlignment="center" borderStyle="line" placeholder="CVV" textAlignment="center" minimumFontSize="17" secureTextEntry="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Kvi-FO-XlV">
                                 <rect key="frame" x="251" y="191" width="108" height="40"/>
                                 <constraints>
                                     <constraint firstAttribute="width" constant="97" id="8Ja-4E-LOH">
@@ -208,7 +208,7 @@
                                     <constraint firstAttribute="height" constant="40" id="fym-P0-fYZ"/>
                                 </constraints>
                                 <fontDescription key="fontDescription" type="system" pointSize="15"/>
-                                <textInputTraits key="textInputTraits" keyboardType="numberPad" enablesReturnKeyAutomatically="YES"/>
+                                <textInputTraits key="textInputTraits" autocapitalizationType="none" autocorrectionType="no" spellCheckingType="no" keyboardType="numberPad" enablesReturnKeyAutomatically="YES"/>
                                 <variation key="default">
                                     <mask key="constraints">
                                         <exclude reference="8Ja-4E-LOH"/>

accept-sample-objc/ViewController.m

@@ -133,21 +133,64 @@ - (void)getToken {
     request.securePaymentContainerRequest.webCheckOutDataType.token.cardCode = self.cardVerificationCode;
 
     [handler getTokenWithRequest:request successHandler:^(AcceptSDKTokenResponse * _Nonnull inResponse) {
-        NSLog(@"success %@", inResponse.getOpaqueData.getDataValue);
+        // SECURITY (AISAST-10660): App-owned defensive parsing. The SDK's
+        // response model uses implicitly-unwrapped-optionals (IUOs) for
+        // server-controlled fields — invoking the getters on a MitM-injected
+        // response that omits 'opaqueData', 'messages.message', etc. would
+        // trap. This block lives in APP-OWNED code (not Pods/), so it
+        // survives `pod install` and shields the host app even if the
+        // SDK regenerates from upstream ~>0.3.0.
+        Messages *messages = [inResponse getMessages];
+        NSString *resultCode = messages ? [messages getResultCode] : nil;
+        OpaqueData *opaqueData = [inResponse getOpaqueData];
+        NSString *dataValue = opaqueData ? [opaqueData getDataValue] : nil;
+        NSString *dataDescriptor = opaqueData ? [opaqueData getDataDescriptor] : nil;
+
+        if (!resultCode || !opaqueData || !dataValue || !dataDescriptor) {
+            // MitM or malformed response — refuse to render token output.
+            NSLog(@"Tokenization success: resultCode=%@ (malformed payload — opaqueData missing)", resultCode ?: @"<nil>");
+            [self updateTokenButton:true];
+            [self.activityIndicatorAcceptSDKDemo stopAnimating];
+            self.textViewShowResults.text = @"Response received but payload was malformed (missing opaqueData). Tokenization aborted.";
+            self.textViewShowResults.textColor = [UIColor redColor];
+            return;
+        }
+
+        // SECURITY: Do not log the opaque payment token — it is a single-use
+        // payment nonce that can be used to charge the customer's card.
+        // Logging it exposes payment data via Xcode console, sysdiagnose
+        // bundles, MDM-collected diagnostics, and pre-iOS-10 system logs.
+        NSLog(@"Tokenization success: resultCode=%@", resultCode);
         [self updateTokenButton:true];
         [self.activityIndicatorAcceptSDKDemo stopAnimating];
-        NSString *output = [NSString stringWithFormat:@"Response: %@\nData Value: %@ \nDescription: %@", [[inResponse getMessages] getResultCode], [[inResponse getOpaqueData] getDataValue], [[inResponse getOpaqueData] getDataDescriptor]];
+        NSString *output = [NSString stringWithFormat:@"Response: %@\nData Value: %@ \nDescription: %@", resultCode, dataValue, dataDescriptor];
         self.textViewShowResults.text = output;
         self.textViewShowResults.textColor = [UIColor greenColor];
 
     } failureHandler:^(AcceptSDKErrorResponse * _Nonnull inError) {
-        //do something
-        Message *msg = [[inError getMessages] getMessages][0];
-        NSLog(@"failed...%@", [msg getText]);
+        // SECURITY (AISAST-10660): App-owned defensive parsing. The SDK's
+        // failure response can carry an empty messages array under MitM
+        // preconditions; indexing [0] on an empty NSArray raises
+        // NSRangeException (Objective-C runtime exception, not a Swift
+        // trap — still crashes the app). Bounds-check before subscript.
+        Messages *messagesObj = [inError getMessages];
+        NSArray<Message *> *messageArr = messagesObj ? [messagesObj getMessages] : nil;
+        NSString *resultCode = messagesObj ? [messagesObj getResultCode] : nil;
+        Message *firstMsg = (messageArr.count > 0) ? messageArr[0] : nil;
+        NSString *errorCode = firstMsg ? [firstMsg getCode] : nil;
+        NSString *errorText = firstMsg ? [firstMsg getText] : nil;
+
+        // SECURITY: Do not log raw server error text — error messages may
+        // contain sensitive context (card details, account info, internal
+        // server state). Log only the structured error code.
+        NSLog(@"Tokenization failed: errorCode=%@", errorCode ?: @"<malformed>");
         [self updateTokenButton:true];
         [self.activityIndicatorAcceptSDKDemo stopAnimating];
-
-        NSString *output = [NSString stringWithFormat:@"Response:  %@\nError code: %@\nError text:   %@", [[inError getMessages] getResultCode], [[[[inError getMessages] getMessages] objectAtIndex:0] getCode], [[[[inError getMessages] getMessages] objectAtIndex:0] getText]];
+
+        NSString *output = [NSString stringWithFormat:@"Response:  %@\nError code: %@\nError text:   %@",
+                            resultCode ?: @"<nil>",
+                            errorCode ?: @"<no error array — possible MitM>",
+                            errorText ?: @"<no error array — possible MitM>"];
         self.textViewShowResults.text = output;
         self.textViewShowResults.textColor = [UIColor redColor];
     }];