react-native-security
Installation
SKILL.md
React Native Security
Covers client-side hardening for React Native 0.8x and Expo SDK 54–58. A mobile client is never trusted: everything here raises the cost of an attack, and the server still has to enforce authorization, rate limits and integrity verdicts. For generic storage choices see
react-native-ecosystem/features-storage.md.
Core References
| Topic | Description | Reference |
|---|---|---|
| Secure storage | expo-secure-store, react-native-keychain v10, biometric-gated secrets, encrypted MMKV, what never to store | core-secure-storage |
| Secrets & bundle | What ends up in the JS bundle, EXPO_PUBLIC_ rules, backend proxies, source maps, Hermes bytecode, R8 |
core-secrets-bundle |
Features
| Topic | Description | Reference |
|---|---|---|
| Network security | HTTPS only, ATS and Android network security config, public key pinning, pin rotation | features-network-security |
| Authentication | OAuth 2.0 + PKCE with expo-auth-session / react-native-app-auth, token lifecycle, biometric unlock | features-authentication |
| Device & app integrity | Jailbreak/root signals, Play Integrity, App Attest, RASP, screenshot protection | features-device-integrity |