Ensuring Mobile Security

---
name: ensuring-mobile-security
description: Ensure app security. Use when handling sensitive data, configuring networking, or preparing for production.
---

# Security Standards

## When to use this skill
- When handling user credentials or sensitive personal data (PII).
- When configuring API calls and networking.
- When implementing authentication logic.
- When preparing the app for a production release.

## Data Storage
- **Credentials**: NEVER store passwords, tokens, or API keys in `AsyncStorage`, `SharedPreferences`, `UserDefaults` (iOS), or `localstorage` (Web).
    - **Use**: Secure storage wrappers like `expo-secure-store` or `flutter_secure_storage` which leverage the OS Keychain/Keystore.
- **Local Data**: Encrypt sensitive databases (e.g., Realm/SQLite encryption) if they contain user data.
- **Cleanup**: Wipe all sensitive local data and tokens immediately upon logout.

## Network Security
- **Transport**: Enforce **HTTPS** for all connections. Block cleartext traffic in `Info.plist` (iOS) and `AndroidManifest.xml` (Android).
- **Certificate Pinning**: Implement certificate pinning for critical APIs to prevent MitM attacks.
- **Validation**: Strict SSL certificate validation.
- **Logging**: NEVER log sensitive headers (Auth tokens) or request bodies containing PII in production or crash reports.

## Authentication
- **Protocol**: Use industry standards like OAuth 2.0 / OIDC. Avoid custom auth schemes.
- **Biometrics**: Use FaceID/TouchID for quick re-auth where appropriate, but always fallback to PIN/Password.
- **Sessions**:
    - Implement short-lived access tokens and long-lived refresh tokens.
    - Enforce local session timeouts for banking/fintech apps.
- **Privacy**: Obscure the app preview in the recent apps switcher (Task Manager) to prevent screenshotting sensitive screens.

## Code Security
- **Production Builds**:
    - Enable code obfuscation (ProGuard/R8 for Android).
    - Strip debug symbols.
    - Remove all `console.log` / `print` statements using build tools (e.g., `babel-plugin-transform-remove-console`).
- **Validation**: Sanitize and validate ALL user inputs on both client and server to prevent injection attacks.
- **Rate Limiting**: Handle 429 Too Many Requests gracefully.