React Native Security

Priority: P0 (CRITICAL)

Store Credentials Securely

• Secure Storage: Use react-native-key-chain for tokens, passwords.
• Never AsyncStorage: Not encrypted. Only for non-sensitive data.
• Biometric Auth: Use react-native-biometrics for Face ID/Touch ID.

See secure storage reference for secure storage with biometric access control.

Validate Deep Links

• Validate URLs: Check scheme and host before navigation.
• Sanitize Params: Never trust URL params. Validate and sanitize.
• Token Extraction: Avoid passing tokens in deep link URLs. Use secure code exchange.

See secure storage reference for deep link URL validation with scheme and host whitelisting.