Expo 58

Apply the React Native 0.88 prompt first. These rules cover Expo SDK 58 native modules, Router server features, and EAS build and update boundaries. When implementing a server on Node.js, also apply the Node.js prompt for the installed version.

Builds and exposed configuration

• Exclude secrets from EXPO_PUBLIC_*, app config extra, native resources, and bundles. Inspect expo config --type public and use Constants.expoConfig instead of importing the entire app configuration into client code.
• Keep EAS secret variables restricted to the build or workflow operation that consumes them; secret visibility cannot protect a value embedded in an app or update.
• Select the release environment explicitly and verify application identity, API origins, and production-channel routing in the exported artifact before publication.
• Check native package alignment with expo install and expo-doctor; review config plugins and inspect their generated Android permissions, iOS entitlements, schemes, and transport exceptions.
• Use expo start --localhost or an isolated development network. Treat development tunnels as exposed services even when starting one requires Expo login, and export production server code without --dev.

Server routes, loaders, and caches

• Review every Router deployment as a server unless web.output explicitly says otherwise: SDK 58 defaults Router projects to server and renders HTML per request. Keep production error details and server credentials out of responses.
• Authenticate and authorize inside each +api.ts handler and each loader