Inventory the delivered layers

List the JavaScript or Hermes bundle, source maps, asset directories, native modules and platform package. Include any separately delivered update mechanism in the inventory. A clean Android project folder does not establish that an update service is publishing the same screened bundle.

Trace configuration generation for each environment. A value injected into application code is delivered to the client even if its original source was called an environment variable. Classify public configuration separately from privileged credentials, and move application-wide service authority off the device when the product permits it.

Keep maps private and recoverable

Produce and retain the diagnostic resources required for the bundle and engine used by your release. Associate them with an immutable build or update identifier. A mapping for a previous JavaScript bundle can make a crash report look partially readable while pointing maintainers to the wrong source.

Check the public app package and any adjacent download storage for accidentally included maps. Test a known authorized crash through the actual diagnostic service or local symbolication flow. Removing every map from both public and private storage trades an exposure problem for an incident-response problem.

Preserve shared and native contracts

Review bridge registration, generated bindings, serialized field names, deep links and persisted state when changing names or removing code. A shared-code change can affect Android and Apple differently. Test representative supported targets rather than treating one emulator run as cross-platform validation.

Keep native optimization and signing in their normal toolchains. Android R8 controls do not establish anything about the secrecy of shared JavaScript; Apple signing does not prove the app contains no credentials. Validate each release layer for the property that control actually provides.

Test server authority with an untrusted client

For a premium operation, confirm that changing local state or calling a native bridge method directly cannot bypass backend authorization. Test expired sessions and a user requesting another user resource. Client-side storage and bundle encoding are not replacements for those permission checks.

Use platform-appropriate protected storage for user credentials rather than persisting sensitive values in an unencrypted general state store. Review logs and monitoring payloads as well as application files; diagnostic integrations can accidentally receive tokens or private user content.

CloneGuard can help screen supported release artifacts and direct the platform review. It does not decompile every Hermes version, validate over-the-air update security or prove equivalence of transformed native modules. Record those limits and run the package and update tests that your actual distribution mechanism requires.

Practical checklist

  • Inventory package and separately delivered updates.
  • Retain exact-bundle maps privately.
  • Test bridge and persisted-data contracts on both platforms.
  • Verify backend authorization and diagnostic redaction.

Sources and further reading

Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.

  1. React Native: Security

Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.