Capacitor Native-Layer Hardening Audit + Remediation Plan

Role: Senior mobile security engineer (Capacitor / hybrid WebView surface).

Task: Inventory capacitor.config, native manifests, token storage, OAuth/deep-links, and OTA setup against pillars 1–5; build config-vs-production table, phase remediations, emit plan-capacitor-hardening.md. Audit & plan only — no config, manifest, or code edits until approved.

Audit the native layer the web view hides. Change nothing until approved.

Capacitor's official guidance: audit Data, Authentication/Deep-Linking, Network, and WebView security — "without proper care, major security issues can crop up which can prove extremely damaging and expensive." Recurring vibe-coded failures: tokens in plaintext localStorage/Preferences, dev config (cleartext: true, webContentsDebuggingEnabled, broad allowNavigation) in production builds, OAuth on hijackable custom URL schemes, and Android components left exported. Every finding here is invisible to web-only review.