Free tool · React Native & Expo
Free React Native security audit
12 checks to catch what attackers look for first: secrets, storage, APIs, deep links and dependencies.
12 checks · 2 minutes
Your security checklist
Answer No, Unknown or Yes. Your score shows up instantly.
01Secrets & storage
0/3No secret key (Stripe secret key, Firebase admin key, OpenAI key…) ships in your JS bundle, app.config or EXPO_PUBLIC_* variables — anything embedded in the app is public.
Auth tokens are stored in expo-secure-store (Keychain/Keystore), never in plain AsyncStorage or MMKV.
Your production logs (console.log, Sentry) contain no tokens, passwords or personal data.
What the audit checks
Four areas from the OWASP MASVS, applied to React Native and Expo.
MASVS-STORAGE
Secrets & storage
Embedded keys, tokens outside the Keychain, leaky logs.
MASVS-NETWORK
Network & API
Cleartext traffic, client-side access control, open APIs.
MASVS-PLATFORM
Platform
Deep links, WebViews, Android backups.
MASVS-CODE
Build & dependencies
Debug artifacts, vulnerable packages, no CI scan.
Automate it with rnsec
rnsec is an open source scanner for React Native and Expo. Run it locally, then in CI to block regressions.
# Local scan + HTML report
npx rnsec scan
# In CI: changed files only
npx rnsec scan --changed-files main --silentFrequently asked questions
Yes. The JS bundle, even as Hermes bytecode, can be extracted from an APK or IPA in minutes. Anything shipped in the app, EXPO_PUBLIC_* variables included, is public. Keep secrets on the server.
Want an expert review?
We audit your codebase and native config, then hand you a fix plan ranked by severity.
Discover the full audit