Security

Security Skill

Applicability

• Platforms: iOS and Android
• React Native: 0.76+ (New Architecture interop assumed unless a checklist item says otherwise)

When to Use

• Handling authentication, tokens, or payments
• Storing or transmitting personal or sensitive data
• Adding or reviewing deep links
• Preparing for a security or privacy review

Guidance

Secrets & Storage

• [ ] No secrets, API keys, or tokens hardcoded (use environment variables)
• [ ] Sensitive data stored in the Keychain (iOS) / Keystore (Android), not plain storage
• [ ] Payment credentials never stored locally (PCI)

Transport

• [ ] Critical endpoints (payments, auth) use SSL pinning
• [ ] Client-side validation is never trusted alone — the server validates too

Logging & PII

• [ ] No PII (names, emails, payment info) logged to console or crash reports
• [ ] Third-party SDK log output audited (SDKs may log sensitive data internally)

Incorrect:

console.log('Payment response:', JSON.stringify(paymentResult));
// Logs a card token to console; ends up in crash reports

Correct:

logger.info('Payment completed', {
  transactionId: paymentResult.id,
  status: paymentResult.status,
});
// Only non-sensitive identifiers

Deep Links & Input

• [ ] Deep-link params validated before navigation (prevent open redirect)
• [ ] Input validated on the client (in addition to, not instead of, the server)

Auth Lifecycle

• [ ] Token refresh handled silently on 401, without losing form state
• [ ] Auth state and navigation reset on sign-out

Privacy & Compliance

• [ ] No analytics or device-data collection before user consent (ATT on iOS, GDPR)
• [ ] Data export and deletion supported (GDPR right to erasure)
• [ ] User data not retained beyond the retention policy
• [ ] Permissions (camera, location) requested explicitly, with graceful denial handling

Pitfalls

• Crash and analytics tools often capture console.log by default — disable or filter them so PII does not leak.
• Third-party SDKs may log sensitive payloads internally; verify their output, not just your own.
• Client validation is a UX nicety, not a security control — the server is the source of truth.
• An unvalidated deep link can redirect users into unintended or authenticated content; validate params first.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Neha
• Source: Neha/rn-developer-skills
• License: MIT

Install and usage instructions live in the source repository linked above.