A developer stores user preferences such as a username and a dark-mode toggle in iOS NSUserDefaults, then later adds a session JWT to the same defaults dictionary for convenience. What security risk has been introduced?

• A.NSUserDefaults plist files are protected only until the first unlock after boot, leaving the token readable in plaintext on any unlocked or backed-up device
• B.NSUserDefaults writes its plist into the app's Caches directory, a location the operating system purges under storage pressure, meaning the session token never survives long enough to be extracted
• C.Values written through NSUserDefaults are hashed with SHA-256 before they reach the plist, always in the same one-way form, leaving the session token unrecoverable from the file even to an attacker holding a full filesystem image