Expo 57

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

5prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. React 1948 lines · 1.4K tokens
  3. TypeScript 6.044 lines · 1.3K tokens
  4. React Native 0.8651 lines · 1.3K tokens
  5. Expo 5758 lines · 1.6K tokens
Total303 lines · 8.8K tokens

CWE Coverage

  • 20
  • 73
  • 79
  • 89
  • 95
  • 117
  • 200
  • 201
  • 208
  • 209
  • 250
  • 295
  • 306
  • 312
  • 319
  • 323
  • 338
  • 346
  • 347
  • 352
  • 362
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 552
  • 602
  • 639
  • 770
  • 798
  • 807
  • 829
  • 838
  • 862
  • 915
  • 916
  • 918
  • 922
  • 926
  • 940
  • 941
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the React Native 0.86, React 19, TypeScript 6.0, and JavaScript ES2026 prompts first. These rules cover Expo SDK 57 configuration, secrets, EAS Update, authentication sessions, deep links, SecureStore, permissions, files, web browser boundaries, builds, and deployment.

Configuration and secrets

  • Treat every value exposed through app config, extra, manifests, constants, and client environment variables as public.
  • Keep API secrets, signing material, service credentials, and privileged endpoints in EAS secrets or server-side secret storage; EAS secret visibility does not protect any value embedded in the app.
  • Separate project IDs, bundle identifiers, schemes, credentials, update channels, and backends across environments.
  • Review config plugins as privileged build code that can change native permissions, components, entitlements, and files.
  • Inspect generated native projects and manifests after prebuild for unintended permissions, exported components, URL schemes, and cleartext traffic.

EAS Update and runtime versions

  • Sign updates with protected keys and configure clients to verify update signatures before launch; changing updates.codeSigningCertificate requires a new native build and runtime version.
  • Set a deliberate runtime version policy so incompatible native and JavaScript code cannot be combined; ensure native changes produce a new runtime version and binary, including an app-version bump when using the appVersion policy.
  • Separate update channels and branches by environment and restrict who can publish, republish, roll back, or