@the-bearded-bear/claude-craft 3.0.0

package/Dev/i18n/en/ReactNative/checklists/refactoring.md

@@ -0,0 +1,303 @@
+# Refactoring Checklist
+
+Safe process for refactoring existing code.
+
+---
+
+## Phase 1: Preparation
+
+### Understanding
+
+- [ ] Current code understood
+- [ ] Refactoring reason clear
+- [ ] Impact evaluated
+- [ ] Scope defined (not too broad)
+
+### Documentation
+
+- [ ] Current code documented (if not already done)
+- [ ] Current behavior captured
+- [ ] Edge cases identified
+- [ ] Dependencies mapped
+
+### Tests
+
+- [ ] All existing tests pass
+- [ ] Coverage baseline established
+- [ ] Additional tests added if needed
+- [ ] E2E tests for critical behavior
+
+---
+
+## Phase 2: Planning
+
+### Strategy
+
+- [ ] Approach defined (Big Bang vs Incremental)
+- [ ] Target pattern/architecture defined
+- [ ] Migration path planned
+- [ ] Rollback strategy prepared
+
+### Risk Assessment
+
+- [ ] Risks identified
+- [ ] Breaking changes anticipated
+- [ ] Dependencies impact evaluated
+- [ ] Timeline estimated
+
+---
+
+## Phase 3: Refactoring
+
+### Incremental Changes
+
+- [ ] Small atomic commits
+- [ ] Tests pass after each commit
+- [ ] Functionality preserved
+- [ ] No behavior changes
+
+### Code Quality
+
+- [ ] Code simpler (KISS)
+- [ ] Duplication eliminated (DRY)
+- [ ] SOLID principles respected
+- [ ] Naming improved
+- [ ] Comments/JSDoc updated
+
+### Tests
+
+- [ ] Tests pass continuously
+- [ ] New tests if patterns changed
+- [ ] Coverage maintained or improved
+- [ ] E2E tests validate behavior
+
+---
+
+## Phase 4: Validation
+
+### Automated Testing
+
+- [ ] Unit tests: All pass
+- [ ] Component tests: All pass
+- [ ] Integration tests: All pass
+- [ ] E2E tests: All pass
+- [ ] No regressions detected
+
+### Manual Testing
+
+- [ ] Feature tested manually
+- [ ] Edge cases verified
+- [ ] Error cases tested
+- [ ] Performance compared
+
+### Code Review
+
+- [ ] Complete self-review
+- [ ] Diff analyzed line by line
+- [ ] No accidental changes
+- [ ] Documentation updated
+
+---
+
+## Phase 5: Deployment
+
+### Pre-Deployment
+
+- [ ] CI/CD tests pass
+- [ ] Code reviewed and approved
+- [ ] Changelog updated
+- [ ] Rollback plan ready
+
+### Deployment
+
+- [ ] Deploy staging first
+- [ ] Smoke tests staging
+- [ ] Monitor staging
+- [ ] Deploy production (if OK)
+
+### Post-Deployment
+
+- [ ] Monitor errors
+- [ ] Check performance metrics
+- [ ] User feedback
+- [ ] Rollback if issues
+
+---
+
+## Refactoring Patterns
+
+### Extract Method
+
+**Before**:
+```typescript
+const processUser = (user: User) => {
+  // 50 lines of code
+  const validated = validateEmail(user.email) && validateAge(user.age);
+  if (!validated) throw new Error('Invalid');
+  const processed = {
+    ...user,
+    fullName: user.firstName + ' ' + user.lastName,
+    initials: user.firstName[0] + user.lastName[0],
+  };
+  return processed;
+};
+```
+
+**After**:
+```typescript
+const validateUser = (user: User): boolean => {
+  return validateEmail(user.email) && validateAge(user.age);
+};
+
+const formatUserName = (user: User) => ({
+  fullName: `${user.firstName} ${user.lastName}`,
+  initials: `${user.firstName[0]}${user.lastName[0]}`,
+});
+
+const processUser = (user: User) => {
+  if (!validateUser(user)) throw new Error('Invalid');
+  return { ...user, ...formatUserName(user) };
+};
+```
+
+- [ ] Long functions extracted
+- [ ] Single responsibility respected
+- [ ] Reusability improved
+
+---
+
+### Extract Component
+
+**Before**:
+```typescript
+const UserProfile = () => {
+  return (
+    <View>
+      <View style={styles.header}>
+        <Image source={{ uri: user.avatar }} />
+        <Text>{user.name}</Text>
+        <Text>{user.email}</Text>
+      </View>
+      <View style={styles.stats}>
+        <Text>Posts: {user.posts}</Text>
+        <Text>Followers: {user.followers}</Text>
+      </View>
+    </View>
+  );
+};
+```
+
+**After**:
+```typescript
+const UserHeader = ({ user }) => (
+  <View style={styles.header}>
+    <Image source={{ uri: user.avatar }} />
+    <Text>{user.name}</Text>
+    <Text>{user.email}</Text>
+  </View>
+);
+
+const UserStats = ({ user }) => (
+  <View style={styles.stats}>
+    <Text>Posts: {user.posts}</Text>
+    <Text>Followers: {user.followers}</Text>
+  </View>
+);
+
+const UserProfile = () => (
+  <View>
+    <UserHeader user={user} />
+    <UserStats user={user} />
+  </View>
+);
+```
+
+- [ ] Components extracted
+- [ ] Reusability improved
+- [ ] Props clearly defined
+
+---
+
+### Introduce Hook
+
+**Before**:
+```typescript
+const MyComponent = () => {
+  const [data, setData] = useState(null);
+  const [loading, setLoading] = useState(false);
+
+  useEffect(() => {
+    setLoading(true);
+    fetch('/api/data')
+      .then(res => res.json())
+      .then(setData)
+      .finally(() => setLoading(false));
+  }, []);
+
+  return loading ? <Spinner /> : <DataView data={data} />;
+};
+```
+
+**After**:
+```typescript
+const useData = () => {
+  const [data, setData] = useState(null);
+  const [loading, setLoading] = useState(false);
+
+  useEffect(() => {
+    setLoading(true);
+    fetch('/api/data')
+      .then(res => res.json())
+      .then(setData)
+      .finally(() => setLoading(false));
+  }, []);
+
+  return { data, loading };
+};
+
+const MyComponent = () => {
+  const { data, loading } = useData();
+  return loading ? <Spinner /> : <DataView data={data} />;
+};
+```
+
+- [ ] Logic extracted to hook
+- [ ] Reusability improved
+- [ ] Component simplified
+
+---
+
+## Common Pitfalls
+
+### ❌ Avoid
+
+- [ ] Refactoring + new features together
+- [ ] Refactoring without tests
+- [ ] Uncommunicated breaking changes
+- [ ] Massive refactoring in one commit
+- [ ] Changing behavior without documenting
+
+### ✅ Do
+
+- [ ] Refactor alone, separate features
+- [ ] Tests before refactoring
+- [ ] Atomic commits
+- [ ] Clear documentation
+- [ ] Behavior preserved
+
+---
+
+## Final Checklist
+
+- [ ] Code simpler than before
+- [ ] No duplication
+- [ ] All tests pass
+- [ ] Performance equal or better
+- [ ] Identical functionality
+- [ ] Documentation up to date
+- [ ] Code review OK
+- [ ] Deployed successfully
+
+---
+
+**Safe refactoring: Test → Refactor → Test → Commit → Repeat**

package/Dev/i18n/en/ReactNative/checklists/security.md

@@ -0,0 +1,380 @@
+# Security Audit Checklist
+
+Comprehensive security audit for React Native application.
+
+---
+
+## 1. Sensitive Data Storage
+
+### SecureStore / Keychain
+
+- [ ] Tokens stored in SecureStore (iOS Keychain / Android Keystore)
+- [ ] Refresh tokens secured
+- [ ] API keys not exposed
+- [ ] Credentials never in plain text
+- [ ] Biometric keys protected
+
+### Code
+
+- [ ] No hardcoded secrets
+- [ ] No tokens in source code
+- [ ] No credentials in logs
+- [ ] `.env` in `.gitignore`
+- [ ] Secrets in EAS Secrets (production)
+
+### Storage
+
+- [ ] MMKV encryption enabled (sensitive data)
+- [ ] No PII in AsyncStorage
+- [ ] Storage cleared on logout
+- [ ] Backup encrypted (iOS/Android)
+
+---
+
+## 2. API Security
+
+### Authentication
+
+- [ ] JWT tokens with short expiration
+- [ ] Refresh token mechanism
+- [ ] Token rotation implemented
+- [ ] Automatic token refresh
+- [ ] Logout clears all tokens
+
+### HTTPS
+
+- [ ] All API calls in HTTPS
+- [ ] No HTTP in production
+- [ ] Certificate pinning (if critical)
+- [ ] TLS 1.2+ minimum
+
+### Headers
+
+- [ ] Authorization header present
+- [ ] CSRF protection (if applicable)
+- [ ] API version in headers
+- [ ] Request ID tracking
+- [ ] User-Agent present
+
+### Request Security
+
+- [ ] Timeout configured (10s max)
+- [ ] Retry logic with backoff
+- [ ] Client-side rate limiting
+- [ ] Request validation
+- [ ] Response validation
+
+---
+
+## 3. Input Validation
+
+### User Input
+
+- [ ] Validation with Zod/Yup
+- [ ] Sanitization before display
+- [ ] Max length enforced
+- [ ] Strict type checking
+- [ ] Secure regex validation
+
+### Forms
+
+- [ ] Email validation
+- [ ] Password strength enforcement
+- [ ] Special characters handled
+- [ ] SQL injection prevented (backend)
+- [ ] XSS prevention
+
+### URL/Deep Links
+
+- [ ] URL validation
+- [ ] Deep link scheme validation
+- [ ] Parameter sanitization
+- [ ] Whitelist allowed hosts
+- [ ] Redirect validation
+
+---
+
+## 4. Authentication & Authorization
+
+### Authentication
+
+- [ ] Secure login flow
+- [ ] Biometric authentication (if available)
+- [ ] 2FA support (if required)
+- [ ] Secure password reset
+- [ ] Account lockout after attempts
+
+### Authorization
+
+- [ ] Role-based access control
+- [ ] Permission checks before actions
+- [ ] Protected routes implementation
+- [ ] API permissions validated
+- [ ] Resource ownership verified
+
+### Session Management
+
+- [ ] Session timeout configured
+- [ ] Automatic logout on inactivity
+- [ ] Concurrent session handling
+- [ ] Session revocation
+- [ ] Secure remember me
+
+---
+
+## 5. Code Security
+
+### Dependencies
+
+- [ ] `npm audit` clean (0 vulnerabilities)
+- [ ] Dependencies up to date
+- [ ] No suspicious packages
+- [ ] Lock file committed
+- [ ] Regular updates scheduled
+
+### Code Quality
+
+- [ ] ESLint security rules
+- [ ] TypeScript strict mode
+- [ ] No `eval()` usage
+- [ ] No `dangerouslySetInnerHTML`
+- [ ] No malicious obfuscated code
+
+### Secrets Management
+
+- [ ] Environment variables used
+- [ ] EAS Secrets for production
+- [ ] Config files gitignored
+- [ ] No secrets in logs
+- [ ] Secrets rotation strategy
+
+---
+
+## 6. Platform Security
+
+### iOS
+
+- [ ] Keychain access configured
+- [ ] NSAllowsArbitraryLoads = false
+- [ ] SSL pinning (if critical)
+- [ ] Screenshot prevention (if sensitive)
+- [ ] Touch ID / Face ID configured
+
+### Android
+
+- [ ] ProGuard / R8 enabled
+- [ ] Network security config
+- [ ] Certificate pinning (if critical)
+- [ ] Screenshot prevention (if sensitive)
+- [ ] Fingerprint / Face configured
+
+### Permissions
+
+- [ ] Minimal permissions
+- [ ] Runtime permissions handled
+- [ ] Permission rationale shown
+- [ ] Denied permissions handled
+- [ ] Permissions documented
+
+---
+
+## 7. Network Security
+
+### Communication
+
+- [ ] HTTPS only
+- [ ] No mixed content
+- [ ] Certificate validation
+- [ ] Pinning (high security)
+- [ ] No clear text traffic
+
+### Data Transit
+
+- [ ] Sensitive data encrypted
+- [ ] No credentials in URL
+- [ ] POST for sensitive data
+- [ ] File uploads secured
+- [ ] Download validation
+
+---
+
+## 8. Offline Security
+
+### Local Data
+
+- [ ] Sensitive data encrypted
+- [ ] Cache invalidation
+- [ ] Old data cleanup
+- [ ] Secure offline auth
+- [ ] Sync conflicts handled
+
+### Storage Cleanup
+
+- [ ] Logout clears cache
+- [ ] Temp files deleted
+- [ ] Images cached securely
+- [ ] Database encrypted
+- [ ] Backup encrypted
+
+---
+
+## 9. Error Handling
+
+### Error Messages
+
+- [ ] No sensitive info in errors
+- [ ] Generic errors to users
+- [ ] Detailed logs server-side only
+- [ ] Stack traces hidden (production)
+- [ ] Error tracking configured
+
+### Logging
+
+- [ ] No credentials logged
+- [ ] No PII logged
+- [ ] Logs sanitized
+- [ ] Log rotation configured
+- [ ] Crash reports secured
+
+---
+
+## 10. Third-Party Security
+
+### SDKs
+
+- [ ] SDKs from trusted sources
+- [ ] Privacy policies reviewed
+- [ ] Data sharing documented
+- [ ] Minimal permissions
+- [ ] Analytics anonymized
+
+### APIs
+
+- [ ] Third-party APIs secured
+- [ ] API keys in secrets
+- [ ] OAuth properly implemented
+- [ ] Minimal scope
+- [ ] Revocable tokens
+
+---
+
+## 11. WebView Security (if used)
+
+- [ ] HTTPS only
+- [ ] JavaScript injection prevented
+- [ ] File access restricted
+- [ ] Content security policy
+- [ ] Domain whitelist
+
+---
+
+## 12. Biometric Security
+
+- [ ] Fallback to passcode
+- [ ] Enrollment verified
+- [ ] Secure element used
+- [ ] Biometric data never stored
+- [ ] Privacy respected
+
+---
+
+## 13. Code Obfuscation (Production)
+
+- [ ] Code obfuscated (Hermes)
+- [ ] Source maps not included
+- [ ] Debug info removed
+- [ ] Console logs removed
+- [ ] Dead code eliminated
+
+---
+
+## 14. Compliance
+
+### GDPR (if EU)
+
+- [ ] Privacy policy
+- [ ] Consent management
+- [ ] Data export feature
+- [ ] Data deletion feature
+- [ ] Cookie consent
+
+### CCPA (if US/CA)
+
+- [ ] Do not sell option
+- [ ] Data disclosure
+- [ ] Deletion rights
+- [ ] Privacy notice
+
+### HIPAA (if health data)
+
+- [ ] Encryption at rest
+- [ ] Encryption in transit
+- [ ] Access controls
+- [ ] Audit logging
+- [ ] BAA in place
+
+---
+
+## 15. Monitoring & Response
+
+### Monitoring
+
+- [ ] Security incidents tracked
+- [ ] Anomaly detection
+- [ ] Failed auth monitoring
+- [ ] API abuse detection
+- [ ] Performance monitoring
+
+### Incident Response
+
+- [ ] Response plan documented
+- [ ] Contact list updated
+- [ ] Rollback procedure
+- [ ] Communication plan
+- [ ] Post-mortem process
+
+---
+
+## 16. Testing
+
+### Security Tests
+
+- [ ] Penetration testing done
+- [ ] OWASP Mobile Top 10 checked
+- [ ] Man-in-the-middle tested
+- [ ] Session hijacking tested
+- [ ] SQL injection tested (backend)
+
+### Code Analysis
+
+- [ ] Static analysis ran
+- [ ] Dynamic analysis ran
+- [ ] Dependency scanning
+- [ ] Secret scanning
+- [ ] License compliance
+
+---
+
+## Final Check
+
+- [ ] All critical items addressed
+- [ ] High severity fixed
+- [ ] Medium severity planned
+- [ ] Documentation updated
+- [ ] Team trained
+
+---
+
+## Security Score
+
+- **Critical**: ___ / ___ ✅
+- **High**: ___ / ___ ✅
+- **Medium**: ___ / ___ ⚠️
+- **Low**: ___ / ___ ℹ️
+
+---
+
+**Security is not a feature, it's a requirement.**
+
+Report generated: {{DATE}}
+Auditor: {{NAME}}