thebeardedbearsas/claude-craft

security-reactnative

Security - React Native 0.85+ Best Practices. Use when reviewing security, implementing auth, or hardening code.

First seen Feb 20, 2026

Installation

$ npx skills add thebeardedbearsas/claude-craft --skill security-reactnative

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

Also in this package

Other skills from thebeardedbearsas/claude-craft · top by installs.

npx skills add thebeardedbearsas/claude-craft

Browse all from thebeardedbearsas/claude-craft

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Also listed on

Alternate registries and mirrors of this skill.

Repository health

Stars 105
License LICENSE
Default branch main
Open issues 0
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,472 B
  • docs SUMMARY.md 140 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 190 installs

SKILL.md

Security - React Native 0.85+ Best Practices

Ce skill fournit les bonnes pratiques de sécurité pour React Native 0.85+ avec la New Architecture.

Principes clés

  • Sécurité native : Keychain (iOS) / Keystore (Android) pour les secrets sensibles (pas AsyncStorage)
  • HTTPS uniquement : ATS (iOS) et Network Security Config (Android) strictes
  • JSI synchrone : validation côté natif des appels TurboModules
  • Expo SecureStore : abstraction sécurisée cross-platform pour les tokens

Spécificités React Native 0.85+

  • TurboModules sécurisés : validation des inputs côté natif avant traitement JSI
  • Bridge legacy supprimé : pas de risques de sérialisation JSON vulnérable
  • Fabric : rendu natif isolé du thread JS (limite les injections UI)
  • Hermes obligatoire : bytecode natif (protection contre le reverse engineering du bundle JS)

Anti-patterns critiques

  • ❌ Stocker des tokens dans AsyncStorage (plaintext)
  • ❌ HTTP non sécurisé en production
  • ❌ Code PIN/biométrie sans SecureStore
  • ❌ Deep links non validés (injection de navigation)
  • ❌ WebView sans validation de l'origine

Sources : OWASP Mobile Top 10, RN Security Best Practices