React Native 0.87

Apply the React 19, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover React Native 0.87 client trust, networking, storage, deep links, WebViews, native modules, permissions, logging, and release builds.

Client trust and application data

• Treat the JavaScript bundle, device state, component state, and all client decisions as attacker controllable; React Native 0.87's default Strict TypeScript API improves compile-time API accuracy but adds no runtime trust boundary.
• Enforce authentication, authorization, price, entitlement, workflow, and integrity rules on trusted servers.
• Keep API secrets, private keys, administrative endpoints, and privileged business logic out of bundles and assets.
• Validate every server response, deep-link value, native-module result, persisted value, and push-notification payload at runtime.
• Clear user-scoped state, queries, caches, and files on logout, account switching, tenant switching, and credential revocation.

Networking and authentication

• Use HTTPS for all remote traffic and keep platform certificate and hostname verification enabled.
• Keep iOS ATS enabled and cleartextTrafficPermitted="false" in Android Network Security Configuration; remove broad ATS exceptions and exclude development CAs from release trust anchors.
• Apply certificate pinning only with a reviewed rotation, backup-pin, expiry, and recovery design.
• Use short-lived tokens with server-side revocation and store refresh credentials in platform-protected storage.
• Use the system browser for OAuth authorization-code flows with PKCE