A developer stores user preferences such as a username and a dark-mode toggle in iOS NSUserDefaults, then later adds a session JWT to the same defaults dictionary for convenience. What security risk has been introduced?

• A.A) NSUserDefaults files are stored in the NSCachesDirectory and are deleted by the OS under storage pressure, erasing the token
• B.B) NSUserDefaults plist files use NSFileProtectionNone by default, making the token readable after first boot without the passcode
• C.C) NSUserDefaults automatically syncs to iCloud, so the token will be replicated to every device signed in with the same Apple ID
• D.D) NSUserDefaults entries are hashed with SHA-256 before writing, so the token cannot be recovered from the file