[robert-goheen-cko]

Changes:

• Add a lazily created opaque privacyCoverView in FramesPaymentViewController.
• setupPrivacyCover() pins it full-screen over view in viewDidLoad; it starts hidden.
• registerPrivacyCoverHandlers() / deregisterPrivacyCoverHandlers() subscribe to UIApplication.willResignActiveNotification / didBecomeActiveNotification (and their UIScene equivalents on iOS 13+) in viewWillAppear / viewWillDisappear.
• addPrivacyCover() brings the cover to front and shows it; removePrivacyCover() hides it again.
• Update testPaymentViewsHierarchy to reflect the new subview count (2).
• Add four new unit tests covering cover visibility on resign/become- active and that observers are cleaned up on viewWillDisappear.

Issue

Issue ticket number and link.

Proposed changes

Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request. If it fixes a bug or resolves a feature request, be sure to link to that issue.

Test Steps

If there's any functionality change, please list a step by step guide of how to verify the changes, and/or upload a screen recording for any visible changes.

For instance:

1. Go to the main screen
2. Tap on primary button
3. Verify the image is shown on the screen

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

• Reviewers assigned
• I have performed a self-review of my code and manual testing
• Lint and unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if applicable)

Further comments

If this is a relatively large or complex change, kick off the discussion by explaining why you choose the solution you did and what alternatives you considered, etc...

[Copilot]

🟡 Changes recommended

Unfiltered scene notifications let unrelated windows change the payment cover’s visibility, while missed activation events can leave the opaque, touch-blocking cover stuck onscreen.

2 open issues

• Filter scene activation events to the owning window · New
• Resync cover visibility when activation observers resume · New

What changed in this PR

Adds a privacy cover to the payment form to prevent card details from appearing in app-switcher snapshots.

Changes:

• Adds an opaque, full-view overlay controlled by application and scene activation notifications.
• Registers and removes privacy observers as the payment controller appears and disappears.
• Updates view-hierarchy assertions and adds four tests for cover visibility and observer cleanup.

File	Description
Tests/​UI/​PaymentForm/​PaymentViewControllerTests.swift	Updates hierarchy assertions and tests privacy-cover behavior.
Source/​UI/​PaymentForm/​ViewController/​FramesPaymentViewController.swift	Adds the privacy overlay and lifecycle notification handlers.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

A critical first-presentation lifecycle issue can leave the privacy cover hidden when the payment scene deactivates, exposing card data in snapshots.

1 open issue

• Refresh scene observers after first window attachment · New

2 resolved since last review

• Filter scene activation events to the owning window
• Resync cover visibility when activation observers resume

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Privacy observers are removed before the payment form is fully hidden, leaving card fields exposed during navigation transitions, and the scene-observer upgrade path lacks effective test coverage.

1 open issue

• Test scene-backed observer upgrade and notification filtering · New

1 previously missed issue

In code that hasn't changed since last review

Keep privacy observers active until the navigation transition completes

Source/​UI/​PaymentForm/​ViewController/​FramesPaymentViewController.swift:128

Removing the observers in viewWillDisappear leaves the payment form unprotected while it is still visible during an animated or interactive navigation transition. For example, backgrounding during an unfinished back swipe delivers the deactivation notification after deregistration, so the cover stays hidden over the visible card fields. Keep privacy observation active until viewDidDisappear, and update the observer-cleanup test to verify protection during the transition as well as cleanup afterward.

1 resolved since last review

• Refresh scene observers after first window attachment

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Privacy observers are removed while card data may still be visible during transitions, creating a capture risk, and the scene-observer handoff lacks effective regression coverage.

3 open issues

• Keep privacy observers until the view disappears · New
• Test observer upgrade with a scene-backed window · New
• Test scene-backed observer upgrade and notification filtering

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Privacy observers are removed in viewWillDisappear while payment fields may still be visible, leaving sensitive card data unprotected if the scene deactivates before the transition completes.

No open issues 🎉

3 resolved since last review

• Test observer upgrade with a scene-backed window
• Keep privacy observers until the view disappears
• Test scene-backed observer upgrade and notification filtering

_{Review effort: Balanced}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🔵 Needs a closer look

Security-sensitive redaction still needs device-level validation of real iOS app-switcher snapshots, since notification-driven tests cannot verify UIKit capture timing with keyboards visible, scene-based hosts, or navigation transitions.

No open issues 🎉

_{Review effort: Balanced}