Making your app's content searchable from the iOS home screen is a nice feature: a user types a few letters in Spotlight and finds the note, message, or item inside your app. You enable it by indexing content with Core Spotlight or marking activities as searchable. But indexing is also a quiet data-leakage path: whatever you put in the search index becomes findable on the device, shows snippets in search results, and is stored in the system index on disk, and some activity options even send content to Apple for public indexing. Index the wrong thing and sensitive data ends up searchable to anyone holding the device. Here is what gets indexed and how to do it safely.
Short answer
iOS lets apps index their content for device search using Core Spotlight (CSSearchableItem) and searchable NSUserActivity, so the content appears in Spotlight results. Per Apple, anything you index becomes searchable on the device, displays snippets in results, and is stored in the on-device search index, and an NSUserActivity marked eligible for public indexing can be sent to Apple's server-side index. The leak is indexing sensitive content, private messages, financial or health data, personal details, which then surfaces in search to anyone with the device, and persists in the index. The fix is to not index sensitive content, mark sensitive activities as not eligible for search or public indexing, and remove indexed items on logout. Index only what is safe to be found.
What you should know
- Apps index content for Spotlight: via Core Spotlight and
NSUserActivity. - Indexed content becomes searchable: findable on the device with snippets.
- The index is stored on disk: persisting as data at rest.
- Public indexing can reach Apple: an activity option sends content server-side.
- Index only non-sensitive content: and remove items on logout.
What gets indexed?
Content you explicitly hand to the search system. There are two main paths. Core Spotlight lets you create searchable items, CSSearchableItem, with attributes like a title, description, and other metadata, and add them to the on-device index so they appear when the user searches; this is how an app makes its internal content, notes, messages, records, findable from Spotlight. The other path is NSUserActivity: when you mark an activity as eligible for search, its content can be indexed too, and if you additionally mark it eligible for public indexing, that signals the content can be added to Apple's server-side index, beyond the device. Both are opt-in, you choose what to index, which is exactly why the leak is a developer decision rather than a default behavior: nothing forces sensitive content into the index, but it is easy to index broadly, or to index a screen's content without thinking about whether it is sensitive.
Where does the leak happen?
In several places once content is indexed. The table lists them.
| Surface | Exposure |
|---|---|
| Device Spotlight search | Indexed content is findable, with snippets shown |
| On-device search index | Content persists in the index, as data at rest |
| Public indexing | An activity eligible for public indexing can reach Apple |
| Handoff and activities | Activity content can move to the user's other devices |
| Shared device in use | Anyone using the device can search it |
The most direct exposure is that indexed content is searchable on the device and shows snippets in results, so anyone using the device, including someone other than the owner, can surface it by typing a query, which matters for private messages, financial figures, or health information. The index is also stored on disk, so indexed content joins the data-at-rest surface and persists even after the in-app view is gone. Marking an activity eligible for public indexing extends the reach to Apple's server-side index, and NSUserActivity can also drive Handoff, moving activity content to the user's other devices. Each is a place sensitive indexed content can show up beyond the in-app screen you intended.
How do you index safely?
Index only non-sensitive content, and control activity options and lifecycle. Start by deciding what is safe to be found in device search: index content that the user would expect and want to be searchable, and do not index sensitive content, private communications, financial or health data, personal identifiers, or anything that should not appear in a search anyone with the device can run. For NSUserActivity, mark sensitive activities as not eligible for search, and be especially careful with public indexing, only marking content eligible for public indexing when it is genuinely public, since that can send it to Apple's index. Manage the lifecycle: remove indexed items when they no longer apply, and clear a user's indexed content on logout so it does not linger in the index or surface for the next person using the device. Treat the search index as part of your data-at-rest footprint, since it persists on disk. The principle is that indexing is publishing to device search, so only publish what is safe to be found, and clean up what should no longer be there.
What to watch out for
The first trap is indexing sensitive content for searchability, which then surfaces in Spotlight to anyone with the device; index only non-sensitive content. The second is marking activities eligible for public indexing without realizing it can send content to Apple's server-side index. The third is leaving a user's indexed items in place after logout, where they persist and can surface for the next user. Indexing is something you configure in your app, so a pre-submission scan such as PTKD.com (https://ptkd.com), which reads the compiled IPA against OWASP MASVS, assesses your app's data-at-rest and privacy posture, the storage surface the search index belongs to, while the decision of what to index is yours to make in code.
What to take away
- iOS apps index content for Spotlight with Core Spotlight (
CSSearchableItem) and searchableNSUserActivity, and indexed content becomes searchable, shows snippets, and persists in the on-device index. - The leak is indexing sensitive content, which then surfaces in device search to anyone with the device, persists as data at rest, and, with public indexing, can reach Apple's server-side index.
- Index only non-sensitive content, mark sensitive activities as not eligible for search or public indexing, and remove indexed items on logout.
- Treat the search index as part of your data-at-rest footprint, and use a pre-submission scan such as PTKD.com to assess your storage and privacy posture.
