React Native 0.88

Last reviewed Oct 19, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. React 1948 lines · 1.4K tokens
  3. TypeScript 6.044 lines · 1.3K tokens
  4. React Native 0.8847 lines · 1.4K tokens
Total241 lines · 7.2K tokens

CWE Coverage

  • 20
  • 73
  • 78
  • 79
  • 89
  • 95
  • 117
  • 200
  • 201
  • 208
  • 209
  • 250
  • 295
  • 306
  • 312
  • 319
  • 323
  • 338
  • 346
  • 347
  • 352
  • 362
  • 419
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 639
  • 770
  • 798
  • 807
  • 829
  • 838
  • 862
  • 915
  • 916
  • 918
  • 922
  • 941
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the React 19 and TypeScript 6.0 prompts first. These rules cover React Native 0.88 Android and iOS applications. For server code or Node-based build extensions, also apply the Node.js prompt for the installed version.

Application and device trust

  • Authorize protected operations on the backend using the current account and resource; native screens, JavaScript state, locally cached roles, and a successful biometric prompt cannot grant server privileges.
  • Keep privileged vendor keys behind an authenticated service. Neither a Hermes bundle nor a compiled native resource protects a secret distributed to every device.
  • Treat native-module results, restored preferences, push data, and links as external input, and validate them before they influence a privileged component or native call.
  • Keep credentials in a maintained platform-secure storage adapter. Do not persist tokens in Async Storage or in a whole application-state snapshot.
  • Scope persisted data and in-flight work to the authenticated identity; cancel or disregard stale work and clear account data on logout, revocation, or tenant changes.

Requests, redirects, and native transport

  • Use HTTPS and WSS with certificate and hostname validation. Preserve iOS ATS and Android cleartext restrictions in the final native configuration, including configuration contributed by libraries.
  • Keep user-added debugging certificate authorities in Android debug-overrides; exclude them from release trust anchors and verify the release android:debuggable value.
  • Enforce authentication and request limits on the