hoangnguyen0403/react-native-security
skills/react-native/react-native-security/SKILL.md
Secure storage, network traffic, and deep links in React Native mobile apps. Use when implementing secure storage, certificate pinning, or deep link validation in React Native.
$ install --global
skillsauthnpx skillsauth add hoangnguyen0403/agent-skills-standard react-native-securityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 28, 2026, 2:44 AM275.6s4 files scanned
SKILL.md
- name:
- react-native-security
- description:
- Secure storage, network traffic, and deep links in React Native mobile apps. Use when implementing secure storage, certificate pinning, or deep link validation in React Native.
React Native Security
Priority: P0 (CRITICAL)
Store Credentials Securely
- Secure Storage: Use
react-native-key-chainfor tokens, passwords. - Never AsyncStorage: Not encrypted. Only for non-sensitive data.
- Biometric Auth: Use
react-native-biometricsfor Face ID/Touch ID.
See secure storage reference for secure storage with biometric access control.
Validate Deep Links
- Validate URLs: Check scheme and host before navigation.
- Sanitize Params: Never trust URL params. Validate and sanitize.
- Token Extraction: Avoid passing tokens in deep link URLs. Use secure code exchange.
See secure storage reference for deep link URL validation with scheme and host whitelisting.
Enforce Network Security
- HTTPS Only: Enforce via
NSAppTransportSecurity(iOS) andnetwork_security_config.xml(Android). - Certificate Pinning: Use
react-native-ssl-pinningfor high-security apps (banking, healthcare). Warning: Requires app update when certificates rotate. - No Secrets in Code: Use
.envfiles withreact-native-config. Add to.gitignore. - Verify: Test by attempting plain HTTP requests in dev; confirm they rejected.
Protect Sensitive Data
- PII Masking: Mask email/phone in logs and analytics.
- Clipboard: Clear sensitive data after paste.
- Screenshots: Block on sensitive screens with
react-native-screen-guard. - Hermes: Bytecode harder to reverse-engineer. ProGuard/R8: Enable on Android.
Anti-Patterns
- No Hardcoded Secrets: Use environment variables.
- No Sensitive Logs: Strip
console.login production. - No Plain HTTP: Always use HTTPS.
- No Client-Side Auth: Validate on backend.
References
See references/secure-storage.md for secure storage, Biometrics, SSL Pinning, and PII Masking.
Related Skills
hoangnguyen0403/common-operator-profile
testing
VerifiedTrustedCommunity
Infer the requesting operator's technical fluency from message content (never ask directly) and adapt register — business, hybrid, or technical — across SDLC workflow output. Use when starting sdlc, brainstorm-feature, plan-feature, verify-work, publish-notes, or session-report, or whenever a request's phrasing signals a non-technical or cross-stack operator.
524SKILL.mdUpdated Jul 12, 2026
hoangnguyen0403/database-transactions
documentation
VerifiedTrustedCommunity
Define transaction boundaries, locking, and consistency guarantees for multi-step writes. Use when designing atomic operations, retries, idempotency, or concurrent write behavior.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-schema-design
development
VerifiedTrustedCommunity
Design relational or document schemas from access patterns, cardinality, and lifecycle. Use when modeling entities, choosing embed vs normalize, or shaping schema boundaries before implementation.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-query-performance
data-ai
VerifiedTrustedCommunity
Diagnose database latency with explain plans, index ownership, and query-shape review. Use when a query is slow, an index is missing, or scans and N+1 patterns appear.
524SKILL.mdUpdated Jun 19, 2026