Security: Secrets, Storage and Certificate Pinning

A React Native app doesn't run on a server you control — it runs on a stranger's device, as a binary that stranger can inspect, decompile, jailbreak, or root at will. Every assumption from server-side engineering about what an attacker can and cannot see is wrong here by default: there is no perimeter, no trusted execution environment you own, and no log you can guarantee stays private, because the entire runtime lives on hardware in someone else's pocket.

This lesson treats two problems as genuinely separate, because conflating them is where most mobile security failures start. The first is data at rest: what happens to a secret — an API key, an auth token, a user's saved credentials — once it exists somewhere on the device. The second is data in transit: what happens to the same secret the moment it crosses the network on its way to your API. Keychain and Keystore solve the first. Certificate pinning solves the second. A team that nails one and skips the other has solved half the problem and can still be fully compromised through the half they skipped.

The cost of getting this wrong is not hypothetical or slow-moving. A hardcoded key sitting in a shipped app bundle is recoverable by anyone with a laptop and a few minutes, not a nation-state adversary — and unlike a server-side leak, there is no way to patch every installed copy of the app the moment you notice. What you ship into a bundle, you ship forever, until every user updates.

Analogy🏏Cricket

🏏 Think of it like cricket: Before the 2023 World Cup final, no team photocopied their bowling plans for Mohammed Shami's death-over yorkers and pinned the sheet to the dressing-room door where the away side's support staff could wander past and read it. A dressing room, on paper, feels like 'home territory' — but during a tour game, the away team's analysts, physios, and even some ground staff move through the same corridors, and anything left in plain sight on a shared wall is effectively public the moment it is written down there. Team India's real practice is the opposite: match-specific bowling plans live in a locked laptop file the bowling coach controls, shown to a player individually, never posted anywhere a passing stranger could photograph it. Just as pinning the plan to a shared wall makes it public regardless of intent, hardcoding an API key into a mobile app's JS bundle makes it public the moment the app ships, because every installed copy of that bundle is a plaintext file sitting on a device you do not control. Just as Team India treats the dressing room as shared space and stores real strategy elsewhere, secure mobile engineering treats the device as attacker-controlled space and stores real secrets in the one place the OS itself protects. The insight is that where you physically put a secret matters more than how confident you are nobody is looking — the dressing-room wall and the JS bundle are both spaces you do not fully control, no matter how private they feel.