Web Push uses a device-specific subscription with endpoint and keys. Delivery passes through the browser or operating-system push service, so payloads should be additionally encrypted and minimised.
iOS has specific installation and permission requirements. Delivery, custom sounds and background behaviour are not identical to native apps and should be documented as platform boundaries.
Three verification questions
- 01Does the push carry unnecessary plaintext?
- 02How is a subscription revoked?
- 03Are platform boundaries documented honestly?