Published is a Swift property wrapper that marks an observable property inside an ObservableObject. When the property changes, SwiftUI and other Combine subscribers receive an update through the enclosing object’s change publisher, so dependent views or observers can react to state changes.
What Published Does in SwiftUI
Published is a property wrapper used with an ObservableObject to make a stored property observable. When the wrapped value changes, the enclosing object emits change notifications so SwiftUI views and Combine subscribers can react automatically instead of polling for updates.
This matters because the wrapper is part of SwiftUI’s state propagation model, not just a naming convenience. It defines where change events originate, how they move through an observable object, and why dependent user interface elements redraw when state changes.
How Published Relates to ObservableObject and Combine
Published is designed to work with the ObservableObject contract and the object’s change publisher. In practice, that means the wrapper helps turn ordinary stored state into a source of reactive updates that can be observed by SwiftUI and other Combine consumers.
The key relationship is that the property itself is not the whole mechanism. The observable object provides the notification boundary, while Published marks which properties should feed that boundary. That separation keeps state modelling explicit and reduces the need for manual update plumbing.
Why Published Exists in Reactive UI Code
SwiftUI depends on predictable state change propagation. Without a wrapper like Published, developers would need more manual signalling to tell the rest of the app that a value changed. The wrapper standardises that signalling so views stay aligned with source of truth state.
It is especially useful when one object owns several pieces of mutable state and those values need to drive independent interface updates. The wrapper keeps those updates local to the object while still allowing the wider reactive system to observe them.
Common Misunderstandings About Published
Published does not make a property globally observable by itself, and it is not a replacement for a broader observation model. It works within an ObservableObject and relies on that object’s change publisher to deliver updates.
It also does not solve data consistency issues on its own. If state changes are coming from multiple execution paths, the wrapper will broadcast those changes, but the application still needs coherent ownership, threading discipline, and sensible state design.
Risk and Threat Considerations
Most risk here is operational rather than adversarial, but misusing reactive state can still create unstable interfaces, stale views, or unexpected update cascades. In larger apps, that can hide logic errors and make state flow harder to reason about during maintenance.
Failure mechanism: Overbroad or poorly owned observable state can trigger unnecessary redraws, feedback loops, or inconsistent UI state when multiple consumers react to the same change publisher.
Impact: Users may see stale, flickering, or contradictory interface behaviour, while developers lose confidence that the displayed state matches the underlying model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP SAMM and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP SAMM | Software Assurance Maturity Model | Reactive state changes affect software design and maintainability. |
| Recommendation — Review state-management practices to keep observable changes intentional and maintainable. | ||
| NIST CSF 2.0 | PR.PO-01 — Policies and procedures are maintained and used to manage protection of information systems and assets | Observable state needs clear development practices and ownership. |
| Recommendation — Define coding conventions for observable state so UI updates remain predictable. | ||
| ISO/IEC 27001:2022 | A.8.28 — Secure coding | Published is a code-level state mechanism that should be implemented safely. |
| Recommendation — Apply secure coding practices when implementing observable state and change propagation. | ||
Practitioner Guidance
Why practitioners should care: Use Published when a property truly represents source-of-truth state that other parts of the interface need to observe. Keep the observable object boundary intentional, because that boundary determines how far change notifications propagate.
What to watch for: If a value changes frequently but should not drive view updates, consider whether it belongs in published state at all. Reserve the wrapper for state that has a real presentation or observation consequence.
Related resources from NHI Mgmt Group
- What breaks when third-party credentials are published in source code?
- Why do organizations delay DMARC enforcement even when policy is already published?
- How should security teams prevent AI assistant files from being published in packages?
- When does MFA alone fall short for published remote applications?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org