React Native 0.83

Apply the React 19 and TypeScript 5.9 prompts first. These rules cover React Native 0.83 on Android and iOS, including applications that add Expo modules. Apply the Node.js prompt for the installed version when writing build tooling or a backend.

Device data and credentials

• Enforce account, tenant, purchase, and object permissions on the backend; React Native component state, native preferences, and a locally unlocked screen cannot authorize a server operation.
• Keep service credentials out of the shipped bundle, native resources, and values injected by react-native-config or react-native-dotenv; use an authenticated backend for privileged vendor calls.
• Use a maintained Keychain/Keystore-backed storage adapter for session credentials. Async Storage is unencrypted, including tokens accidentally included in persisted Redux or query state.
• On logout or account change, delete credentials through the storage adapter and clear identity-scoped persisted state; prevent outstanding native callbacks from restoring the previous account's data.
• Redact request bodies, authentication headers, and persisted state before native logs, JavaScript logs, crash reporting, or analytics capture them.

Native network transport

• Keep iOS App Transport Security enabled and restrict any required exceptions to specific domains. On Android, prohibit cleartext with the manifest or Network Security Configuration; do not add a permissive base configuration.
• Restrict debugging trust anchors to Android debug-overrides; verify the release manifest is not debuggable and that