Entitlement Get-Task-Allow in Release

The get-task-allow entitlement controls whether other processes (most notably a debugger such as lldb) can attach to the running app via the Mach task_for_pid interface. Xcode enables it automatically for Debug builds so the IDE can attach, and clears it for distribution configurations. When a Release entitlements file still carries get-task-allow = true, shipped binaries remain debug-attachable — opening a path to runtime inspection, memory dumping, and method swizzling on jailbroken devices.

The rule cross-references project.pbxproj to determine which entitlements file is wired to the Release configuration (via CODE_SIGN_ENTITLEMENTS), so it only flags the file that actually ships.

Many leaks happen because a developer copy-pastes a Debug entitlements file into the Release slot or forgets to delete the key after a one-off debugging session against a TestFlight build. Tooling that inspects only the binary won’t catch it before the upload; an entitlements-file scan will.

Remove the get-task-allow key from the Release entitlements file, or set it to false. Keep a separate Debug entitlements file if your project relies on the key locally — wire the two files via the {Debug,Release} pair of CODE_SIGN_ENTITLEMENTS build settings.