security-mobilelisted

# Mobile Security — MASVS-Aligned Patterns For React Native bare apps targeting iOS 16+ and Android 14+. Aligned with OWASP MASVS v2.0 (the 2024 update). Targets the realistic threat model of a consumer mobile app — not a banking app under nation-state attack, but a real app with payments, PII, and user accounts where a breach hurts. ## When to Use This Skill - Storing tokens / credentials / secrets on the device. - Choosing certificate pinning strategy (or whether to pin at all). - Adding root/jailbreak detection. - Designing biometric prompts for sensitive ops. - Reviewing native-module surface area. - Planning what NOT to log/screenshot/leak. - Auditing third-party SDKs for risky permissions. - Pre-flight before App Store / Play Store submission. For server-side / API-side security, see `security-web`. For auth flows specifically, see `auth-patterns`. ## The Threat Model — Realistic Priorities Mobile threat ranking for a consumer app (high → low priority): 1. **Lost device, no biometric / weak passcode** → app session compromised. Mitigation: biometric gate on launch + on sensitive ops; idle timeout; remote logout. 2. **Phishing → credential theft** → standard password takeover. Mitigation: passkeys (phishing-proof), magic-link with same-device check. 3. **Malicious / compromised library on the client** → can read in-memory state. Mitigation: minimize deps, audit weekly, prefer first-party libs. 4. **Insecure data at rest** → device backup or filesystem inspection l