secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.0117·Published 2020-08-26·Fixed in 9.1.0