Apple secure notes. How secure? In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below:

The Notes app includes a Secure Notes feature that allows users to protect the contents of specific notes. Secure notes are encrypted using a user-provided passphrase that is required to view the notes on iOS, macOS, and the iCloud website.
When a user secures a note, a 16-byte key is derived from the user’s passphrase using PBKDF2 and SHA256. The note’s contents are encrypted using AES-GCM. New records are created in Core Data and CloudKit to store the encrypted note, tag, and initialization vector, and the original note records are deleted; the encrypted data isn’t written in place. Attachments are also encrypted in the same way.
When a user successfully enters the passphrase, whether to view or create a secure note, Notes opens a secure session. While open, the user isn’t required to enter the passphrase, or use Touch ID, to view or secure other notes. However, if some notes   have a different passphrase, the secure session applies only to notes protected with   the current passphrase. The secure session is closed when the user taps the Lock Now button in Notes, when Notes is switched to the background for more than 3 minutes, or when the device locks.
From a cryptographic standpoint (ignoring implementation issues and password sniffing), the security depends primarily on the entropy $s$ in the password, and the number $n$ of iterations in PBKDF2. Work to break is about $n\,2^{s-1}$ SHA-256 (for large $n$).

Per the obligatory XKCD, a good password has like 44 bits of entropy; a bad password (among the 1000 most common) like 10 bits.

According to that source, $n$ was $10^4$ in iOS 4.x; I'll use $n=2^{16}$ (6.5 times more).

Thus the effort to break the system is like $2^{25}$ to $2^{60}$ SHA-256.

$2^{25}$ SHA-256 is very easy. $2^{60}$ is considerable, but feasible for an entity like the NSA if it decides to invest in the necessary hardware (ASICs specialized in cracking PBKDF2). As a comparison, according to this source, bitcoin miners currently hash at a rate of $10^{19}$ SHA-256d per second, where one SHA-256d is two SHA-256; that is over $2^{70}$ SHA-256 per minute.

Nowadays, if something is protected only by a password, and can be accessed on a mobile device, and the key stretching step uses PBKDF2 without the hash in hardware, and the password is of average quality, likely it could be broken. For something safer, we want scrypt or Argon2, that leverage RAM to make the investment in a password cracker much higher; or an exceptionally good password.