SwiftUI 26

Apply the Swift 6.3 and iOS SDK 26 baselines first. These rules cover SwiftUI in the iOS and iPadOS 26 SDK family, including WebKit's SwiftUI integration. Use a compatible Swift 6.3 toolchain, such as Xcode 26.4, and check each API's deployment availability. Gate WebView and WebPage behind iOS/iPadOS 26 availability when supporting earlier deployment targets.

State and data flow

• Keep secrets and sensitive records out of @SceneStorage and @AppStorage. SceneStorage persists restoration values at system-controlled times, and AppStorage uses UserDefaults; neither is a credential store.
• Use SecureField for password entry with a short-lived, private binding, which may use @State. Its string remains readable by application code; clear the binding when the flow completes or is abandoned, avoid copying it into other view models, and persist credentials only through the baseline's protected storage.
• Scope @State, @StateObject, and environment models to the intended account and scene. A @StateObject is not recreated merely because an account argument changes; explicitly replace account-owned models or change the owning view's identity, and clear selections, sheets, and navigation paths on logout or account switching.
• Pass only necessary draft values through @Binding or @Bindable and narrowly scoped services through .environment. Enforce privileged changes in the model or service operation; a writable binding, environment value, or .disabled modifier is not an authorization boundary.
• Keep body and state initialization free of network