← all checklists

React Native

16 items · source

Copy as markdown

Filter items

Mobile Applications

• Verify AsyncStorage holds nothing sensitive — it is unencrypted plain text on both platforms.
• Verify tokens and credentials use Keychain (iOS) and Keystore/EncryptedSharedPreferences (Android) via a vetted library.
• Verify no secret is embedded in the JavaScript bundle; react-native-config and .env values are compiled into the binary and are trivially extractable.
• Verify the release build ships Hermes bytecode rather than readable JavaScript, and understand that this is obfuscation, not protection.
• Verify __DEV__-only code — debug menus, mock logins, verbose logging — cannot execute in release.
• Verify Flipper and any remote debugging bridge are excluded from release builds.
• Verify certificate pinning is implemented if the threat model requires it, and that it fails closed.
• Verify Android usesCleartextTraffic is false and iOS App Transport Security has no blanket exception.

Web Frontend

• Verify WebView sets originWhitelist narrowly and does not default to ['*'].
• Verify injectedJavaScript and postMessage handlers never evaluate content received from the page.
• Verify WebView does not enable allowFileAccess or allowUniversalAccessFromFileURLs unless required.

Authentication & Authorization

• Verify deep link and universal link handlers authenticate and authorize before acting — a link is attacker-supplied input.
• Verify the app does not treat any client-side role or feature flag as an authorization decision.

Pre-Release Gates

• Verify over-the-air update channels (CodePush, Expo Updates) are signed and that the signing key is not in the repository.
• Verify the OTA channel cannot be pointed at an attacker-controlled endpoint by a deep link or debug setting.
• Run npm audit against the JS dependency tree and review native dependencies separately.