Ionic / Capacitor mobile security

An Ionic app is an Angular app running in a native WebView with a bridge to native code. It inherits every web risk (see angular-security - XSS, CSP, token storage, CSRF) plus a native attack surface the browser does not have: on-device storage an attacker with the device can read, deep links other apps can fire, native permissions, and the WebView container itself. This is the native map. Assume the device may be lost, rooted, or shared, and that another app on it is hostile.

Secret and token storage

• Capacitor Preferences, localStorage, and IndexedDB are plaintext on the device - never store tokens, keys, or PII in them. Use a secure-storage plugin backed by the iOS Keychain and Android Keystore (a Keychain / secure-storage plugin); the encryption key lives in the Keystore/Keychain, not in JS.
• On the web fallback there is no Keychain - degrade explicitly (a shorter-lived in-memory token, or refuse the sensitive path), never silently fall back to plaintext.
• Clear the secure store on logout, and do not log token values.

Deep links, custom schemes, universal links

• A deep link - a custom scheme (myapp://) or an App / Universal Link - is attacker-reachable input. Validate every parameter before it routes, authenticates, or performs an action; never auto-run a state-changing operation from a deep link without a confirmation step.