I currently found something interesting when browsing my iPhone app's cache.db file.
There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all the HTTP Request response that my app receives from the API. The problem is there is an HTTP request that responds with the user's API key. The column shows this data in plain text.
My question is should I worry about this? We do have a way where the user can change/delete their API key as a safety protocol.
This is where I found the cache.db just in case it helps someone understand my concern.
Ive updated my question because all the data in this column is actually responses from the API and not requests I send out.