React Native 0.86

Apply the React 19, TypeScript 5.9, and JavaScript ES2026 prompts first. These rules cover React Native 0.86 client trust, networking, storage, deep links, WebViews, native modules, permissions, logging, and release builds.

Client trust and application data

• Treat the JavaScript bundle, device state, component state, and all client decisions as attacker-controllable; 0.86's opt-in Strict TypeScript API improves compile-time API accuracy but adds no runtime trust boundary.
• Enforce authentication, authorization, price, entitlement, workflow, and integrity rules on trusted servers, and keep API secrets, private keys, administrative endpoints, and privileged business logic out of bundles and assets.
• Validate every server response, deep-link value, native-module result, persisted value, and push-notification payload at runtime.
• Clear user-scoped state, queries, caches, and files on logout, account or tenant switching, and credential revocation.

Networking and authentication

• Use HTTPS for all remote traffic with platform certificate and hostname verification on. Keep iOS ATS enabled without broad NSAllowsArbitraryLoads exceptions, and block release cleartext traffic with Android Network Security Configuration cleartextTrafficPermitted="false".
• Apply certificate pinning only with a reviewed rotation, backup-pin, expiry, and recovery design.
• Use short-lived tokens with server-side revocation, and store refresh credentials in platform-protected storage.
• Use OAuth authorization code flow with PKCE (S256) in a system browser or platform authentication