React Native Security

Priority: P0 (CRITICAL)

Store Credentials Securely

• Secure Storage: Use react-native-key-chain for tokens, passwords.
• Never AsyncStorage: Not encrypted. Only for non-sensitive data.
• Biometric Auth: Use react-native-biometrics for Face ID/Touch ID.

See secure storage reference for secure storage with biometric access control.

Validate Deep Links

• Validate URLs: Check scheme and host before navigation.
• Sanitize Params: Never trust URL params. Validate and sanitize.
• Token Extraction: Avoid passing tokens in deep link URLs. Use secure code exchange.

See secure storage reference for deep link URL validation with scheme and host whitelisting.

Enforce Network Security

• HTTPS Only: Enforce via NSAppTransportSecurity (iOS) and network_security_config.xml (Android).
• Certificate Pinning: Use react-native-ssl-pinning for high-security apps (banking, healthcare). Warning: Requires app update when certificates rotate.
• No Secrets in Code: Use .env files with react-native-config. Add to .gitignore.
• Verify: Test by attempting plain HTTP requests in dev; confirm they rejected.

Protect Sensitive Data

• PII Masking: Mask email/phone in logs and analytics.
• Clipboard: Clear sensitive data after paste.
• Screenshots: Block on sensitive screens with react-native-screen-guard.
• Hermes: Bytecode harder to reverse-engineer. ProGuard/R8: Enable on Android.

Anti-Patterns

• No Hardcoded Secrets: Use environment variables.
• No Sensitive Logs: Strip console.log in production.
• No Plain HTTP: Always use HTTPS.
• No Client-Side Auth: Validate on backend.

References

See references/secure-storage.md for secure storage, Biometrics, SSL Pinning, and PII Masking.

Pinning verification checklist

• Test that a request fails with an untrusted or changed certificate, and document rotation and recovery before shipping certificate pins.