Inquiry Regarding File Handling & Sensitive Data Storage in Mapbox SDK.

Nobody has claimed this yet.

Hello Mapbox Team,

We are currently conducting a detailed security review of our mobile application, which integrates the Mapbox SDK.
During a recent static security scan, two potential issues were flagged related to data storage and file handling:

---

**1. Unsafe Files Deletion**
The scanner flagged a potential risk where files managed by the Mapbox SDK (e.g., offline maps, cached map tiles, or temporary files) might not be securely deleted, potentially leaving residual data artifacts on the device.

**2. Cleartext Storage of Sensitive Information**
The scan indicated possible instances where sensitive information (such as tokens, configuration data, or user-related data) may be stored or cached in plaintext within app-accessible file locations or resources.

---

**Our questions for you:**
1. Does the Mapbox SDK implement **secure deletion practices** for cached or stored files (e.g., offline maps, temp files)?
2. Does the SDK **store any sensitive data in plaintext** locally? If so, are there **recommended best practices** or **configuration options** to encrypt or secure such data?
3. Do you have **documentation or security guidelines** clarifying how Mapbox SDK handles file storage, deletion, and sensitive data protection?

Your clarification will assist us in documenting secure usage practices and ensuring alignment with security standards such as OWASP MASVS.

We are happy to provide relevant excerpts from the scan report if required.

Thank you in advance for your assistance.

The issue names no files, tests, or entry points. Start by reviewing the static-scan excerpts and the SDK's documented handling of cached, offline, temporary, and sensitive files; the work is done when secure-deletion behavior, plaintext storage risks, and recommended protections are clearly documented.

Written by the indexing model from the issue text.