Entitlement Keychain Access Groups Wildcard

The keychain-access-groups entitlement declares the set of access groups the app may read from or write to in the iOS Keychain. Entries normally carry the form <TeamID>.<bundle> — a literal, team-scoped identifier. A wildcard entry ( or anything containing ) drops that scoping and lets the app share secrets with keychain trust groups whose contents the developer never explicitly opted into. An empty-string entry is symptomatic of a leftover template/placeholder that the build accepted silently and has the same broad effect at runtime.

Broad keychain access groups undermine the isolation Keychain Services otherwise provides. Other apps with overlapping wildcard groups can read every credential the offending app writes.

List each group explicitly with its team prefix; remove placeholder and * entries.