We develop a financial application that will allow payment and other important actions, we also use some SDKs to help us with some functions. Including SDK in our app based on what I understand will have access to:
- The same keychain our app has access to
- Any folders/files our app has access to
- Any app permissions our app has, e.g. location data, photo library access
- iCloud containers of our app
- All data our app exchanges with a web server, e.g. user logins, personal information
Having third-party SDK implemented part of our app, we don't need third party SDK to have such permission but I understand it will as default when using third-party SDK. How do we make sure to cover all those and other potential third-party SDK hacks on our main application?