reis-mobile 0.4.0 → 0.6.0

package/skills/mobile-rn/references/performance-release.md

@@ -0,0 +1,46 @@
+# React Native performance and release
+
+## Measure before optimizing
+
+- The React profiler in React Native DevTools (or the DevTools version for the project's React Native release) to find components that re-render.
+- The performance monitor for JavaScript and UI frame rates; native profilers (Instruments, Android Studio) for native modules and startup.
+- Test performance in release builds on real devices: development builds are much slower.
+
+## Common fixes
+
+- **Re-renders:** narrow context values, memoize expensive children with stable props, select store slices, keep fast-changing state local.
+- **Lists:** virtualized lists with stable keys and memoized rows (see `ui-navigation.md`).
+- **JavaScript thread:** move animations to Reanimated worklets; defer heavy work until after interactions; avoid large synchronous JSON parsing during navigation.
+- **Startup:** keep Hermes enabled, avoid importing heavy modules at the entry point, show the first screen before loading optional data.
+- **Bundle and size:** remove unused dependencies, check which libraries pull large native SDKs, and remove `console.log` in release builds.
+
+## Versioning
+
+- User-facing version: `version` in the Expo app config, or the native version fields in bare projects (`versionName` on Android, `MARKETING_VERSION` on iOS).
+- Build numbers: iOS `buildNumber` and Android `versionCode` must increase for every store upload. EAS can manage them with `appVersionSource: "remote"` and `autoIncrement` in `eas.json`.
+
+## Building
+
+**Expo / EAS:**
+
+```bash
+eas build --platform ios --profile production
+eas build --platform android --profile production
+eas submit --platform ios --latest
+```
+
+- Build profiles live in `eas.json` (development, preview, production); credentials are managed by EAS or provided by the team.
+- Environment variables per environment are configured in EAS; values available to the app code are public.
+
+**Bare React Native:** `./gradlew bundleRelease` in `android/` for an AAB, and an Xcode archive for iOS; store requirements and signing follow `mobile-android` and `mobile-ios`.
+
+## Over-the-air updates
+
+- EAS Update (or the update service the project uses) ships JavaScript and asset changes only. Anything that changes native code, native config or config plugins needs a new store build.
+- `runtimeVersion` must change whenever the native layer changes, so an update never reaches a binary it is incompatible with; prefer a policy such as `fingerprint` or `appVersion` over manual values when possible.
+- Publish to a preview channel first, then roll out to production; keep a way to roll back.
+- Store rules restrict what updates may change (for example, no new features that bypass review on iOS); check the current guidelines.
+
+## Crash reporting
+
+Upload source maps for release bundles (and dSYMs and R8 mappings for native code) to the crash reporter, so JavaScript and native stack traces are readable.

package/skills/mobile-rn/references/platform-features.md

@@ -0,0 +1,40 @@
+# React Native platform features
+
+## Permissions
+
+- Expo modules expose permission hooks and methods (`useCameraPermissions`, `Location.requestForegroundPermissionsAsync`...); bare projects often use `react-native-permissions`.
+- Declare iOS usage descriptions and Android permissions in native config: in Expo, through the module's config plugin options or `ios.infoPlist` and `android.permissions` in the app config; in bare projects, in `Info.plist` and `AndroidManifest.xml`.
+- Ask in context, handle "denied" and "blocked", and link to settings with `Linking.openSettings()`.
+
+## Push notifications
+
+- **Expo:** `expo-notifications` for permissions, tokens, foreground handling (`setNotificationHandler`) and taps; the Expo push service or your own backend with FCM/APNs credentials. Push does not work in Expo Go on every platform and SDK version; use a development build.
+- **Firebase Cloud Messaging:** follow `mobile-firebase` (React Native Firebase).
+- Android 13+ needs the notification permission; iOS needs the Push Notifications capability and an APNs key.
+- Register background handlers at the app entry, outside components.
+
+## Deep links
+
+- Custom scheme: `scheme` in the Expo app config, or intent filters and URL types in bare projects.
+- Universal links and app links: `ios.associatedDomains` and `android.intentFilters` with `autoVerify` in Expo, plus the `apple-app-site-association` and `assetlinks.json` files on your domain.
+- Route links through the navigator's linking configuration and validate parameters before acting.
+
+## Background work
+
+- Periodic background work is limited and scheduled by the OS. In Expo, use the background task module of the SDK in use (`expo-background-task` replaced `expo-background-fetch`; check the SDK docs) with `expo-task-manager`.
+- Uploads and long jobs that must finish belong on the server or in native background transfer APIs, not in JavaScript timers.
+
+## Native modules and config
+
+- **Expo Modules API:** write native modules in Swift and Kotlin with a typed JavaScript interface; works in Expo and bare projects.
+- **Turbo Modules / Fabric components:** the New Architecture native module system in bare projects; define the spec in TypeScript and generate code with Codegen.
+- **Config plugins:** change native projects (Info.plist, manifest, Gradle, Podfile) reproducibly in Expo projects with Continuous Native Generation. Do not hand-edit `android/` and `ios/` in such projects; changes are lost on `npx expo prebuild --clean`.
+- Wrap each native module once in a typed TypeScript API.
+
+## Device capabilities
+
+Camera (`expo-camera` or `react-native-vision-camera`), location (`expo-location`), media library, biometrics (`expo-local-authentication`), haptics and sensors: prefer the libraries the project already uses, check that they support the New Architecture when it is enabled, and add their permissions.
+
+## In-app purchases
+
+Use a maintained library (for example RevenueCat's SDK or `react-native-iap`) or the store APIs through native modules; verify purchases and entitlements on a server, and test with store sandbox accounts. Store rules for digital goods are in `mobile-ios` and `mobile-android`.

package/skills/mobile-rn/references/ui-navigation.md

@@ -0,0 +1,62 @@
+# React Native UI and navigation
+
+## Navigation
+
+Use the router the project has.
+
+**React Navigation** (native stack):
+
+```tsx
+export type RootStackParamList = { Orders: undefined; OrderDetail: { orderId: string } };
+const Stack = createNativeStackNavigator<RootStackParamList>();
+
+export function RootNavigator() {
+  return (
+    <Stack.Navigator>
+      <Stack.Screen name="Orders" component={OrdersScreen} />
+      <Stack.Screen name="OrderDetail" component={OrderDetailScreen} />
+    </Stack.Navigator>
+  );
+}
+```
+
+**Expo Router** (file-based): routes are files under `app/` (`app/orders/[orderId].tsx`), layouts are `_layout.tsx`, navigation uses `<Link href="/orders/42">` or `router.push`, and params come from `useLocalSearchParams`.
+
+- Type route params and pass ids, not objects or functions.
+- Configure deep linking in the router (the `linking` option, or Expo Router's automatic routes) so notifications and links open the right screen.
+- Use native stack navigators for native transitions and gestures.
+
+## Layout and styling
+
+- `StyleSheet.create` or the styling library the project uses; Flexbox with `flexDirection: 'column'` as the default.
+- Safe areas with `react-native-safe-area-context` (`SafeAreaView` or `useSafeAreaInsets`); the core `SafeAreaView` only works on iOS.
+- Dark mode with `useColorScheme` and a theme object, not hardcoded colors.
+- Platform differences in `.ios.tsx`/`.android.tsx` files or `Platform.select`, kept small.
+
+## Lists
+
+- `FlatList`/`SectionList` (or FlashList, if the project uses it) for long or dynamic data, with a stable `keyExtractor`.
+- Memoize `renderItem` components and avoid inline objects on hot rows; provide `getItemLayout` for fixed-height rows.
+- Pull to refresh with `refreshing`/`onRefresh`; pagination with `onEndReached` guarded against duplicate calls.
+
+## Forms and keyboard
+
+- A form library the project has (React Hook Form is common), with schema validation shared with the API layer when possible.
+- `KeyboardAvoidingView` (behavior differs per platform) or a keyboard library the project uses; `keyboardShouldPersistTaps="handled"` on scroll views with inputs.
+- Set `textContentType` (iOS) and `autoComplete` for autofill, and `returnKeyType` with focus chaining between fields.
+
+## Gestures and animations
+
+- Reanimated for animations that run on the UI thread, Gesture Handler for gestures; `Animated` with `useNativeDriver: true` for simple cases.
+- Do not drive per-frame animation through React state.
+
+## Images
+
+`expo-image` (or the image library the project uses) for caching and placeholders; size images close to their display size.
+
+## Accessibility and localization
+
+- `accessibilityRole`, `accessibilityLabel` and `accessibilityState` on touchables; `accessible` groups for composite elements.
+- Respect font scaling; do not set `allowFontScaling={false}` on body text. Touch targets of at least 44–48 points (`hitSlop` for small icons).
+- Test with VoiceOver and TalkBack.
+- Localize with the library the project uses (for example i18next) and the device locale from `expo-localization` or equivalent.

package/skills/mobile-security/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: mobile-security
+description: Security review and hardening for mobile apps on every stack, organized by the OWASP MASVS categories — insecure token and credential storage, hardcoded secrets, cleartext traffic and TLS validation bypass, certificate pinning, exported components and intent handling, deep links, WebView bridges, biometrics, sensitive logging, backups, screenshots and release hardening — with concrete checks for Flutter, native Android, native iOS and React Native. Use when reviewing mobile code for security, auditing an app before release, storing tokens or credentials, handling authentication, deep links or WebViews, or when the user mentions OWASP, MASVS, pentest findings or store security requirements.
+intents: [review, security, release]
+stacks: ["*"]
+---
+
+# Mobile Security
+
+Organized by the OWASP MASVS categories. Apply the general checks below, then the reference for the detected stack. In cross-platform apps, also apply the Android and iOS references to the native folders.
+
+## 1. Pick the reference
+
+| Project | Read |
+|---|---|
+| Flutter | [references/flutter.md](references/flutter.md) |
+| Native Android (Kotlin/Java), or `android/` in any app | [references/android.md](references/android.md) |
+| Native iOS (Swift/Objective-C), or `ios/` in any app | [references/ios.md](references/ios.md) |
+| React Native or Expo | [references/react-native.md](references/react-native.md) |
+
+Firebase-specific protection (security rules, App Check) is covered by `mobile-firebase`.
+
+## 2. Evidence and severity
+
+Every finding needs evidence in the code or configuration at `file:line`. Severity:
+
+- **Critical:** exposed credential or sensitive data, TLS validation disabled, exported component that performs a privileged action, backend authorization missing.
+- **High:** token in insecure storage, cleartext traffic to the API, WebView with a JavaScript bridge exposed to remote content, deep link acting without validation.
+- **Medium/Low:** missing hardening, verbose logs, backup enabled without need, missing screenshot protection.
+
+## 3. General checks (all stacks)
+
+**MASVS-STORAGE**
+- [ ] Access token, refresh token and personal data kept in insecure storage (preferences, plain files, unencrypted database) instead of the Keychain or Keystore-backed storage.
+- [ ] Sensitive data in logs, analytics events or crash reports.
+
+**MASVS-CRYPTO**
+- [ ] Private API keys, client secrets, signing keys or passwords in source code, assets or bundled configuration. Everything shipped in the app can be extracted; a real secret stays on the backend.
+- [ ] Homemade cryptography, fixed IV or key, MD5/SHA-1 for passwords.
+
+**MASVS-AUTH**
+- [ ] Authorization decided only on the client (a local `isAdmin` flag, hiding a button as access control).
+- [ ] Sessions without expiration, or refresh tokens never invalidated on logout.
+- [ ] Biometrics used only as a local boolean, without unlocking a key in the Keychain or Keystore.
+
+**MASVS-NETWORK**
+- [ ] `http://` URLs for APIs.
+- [ ] Certificate validation disabled or overridden to accept everything.
+- [ ] Pinning, if present, without a rotation strategy (a single pin with no backup).
+
+**MASVS-PLATFORM**
+- [ ] Deep links and universal/app links that perform actions without validating parameters or without authentication.
+- [ ] WebViews loading remote content with JavaScript and a native bridge enabled.
+- [ ] Sensitive data on the clipboard or visible in the app switcher snapshot.
+
+**MASVS-CODE / RESILIENCE**
+- [ ] Release builds without obfuscation or minification when the app has sensitive logic.
+- [ ] Debug code, test endpoints or feature flags that bypass checks reachable in release.
+- [ ] Dependencies with known vulnerabilities, or abandoned security-sensitive libraries.
+
+**MASVS-PRIVACY**
+- [ ] Permissions requested without real use in the code.
+- [ ] Third-party SDKs collecting data that is not declared (privacy manifest and App Store privacy details on iOS, Data safety on Google Play).
+
+## 4. Useful commands (read-only)
+
+```bash
+# Signing material and environment files that should not be in the repository
+git ls-files | grep -Ei '\.(jks|keystore|p12|p8|pem|mobileprovision)$|key\.properties|(^|/)\.env(\.|$)'
+
+# Android manifest flags worth reading in context
+grep -rn --include='AndroidManifest.xml' -E 'usesCleartextTraffic|allowBackup|exported="true"|debuggable' . 2>/dev/null
+
+# iOS App Transport Security exceptions
+grep -rn --include='*.plist' 'NSAllowsArbitraryLoads' . 2>/dev/null
+```
+
+`google-services.json` and `GoogleService-Info.plist` identify a Firebase project and ship in every app; committing them is not a leak by itself. The findings there are unrestricted API keys and weak security rules.
+
+## Output
+
+Report under **Security** (or **Critical**, when the severity is Critical), with the MASVS category, `file:line`, impact and fix.

package/skills/{android-intent-security/SKILL.md → mobile-security/references/android/intent-security.md}

@@ -1,31 +1,4 @@
----
-name: android-intent-security
-description: Best practices for Android Intent security. Use this skill when auditing
-  component configurations in AndroidManifest.xml activities, services, receivers)
-  or source code handling incoming Intents (getIntent, getParcelableExtra) to prevent
-  Intent Redirection and unauthorized access.
-license: Apache-2.0
-source: https://github.com/android/skills
-intents: [security, review]
-stacks: [android]
-metadata:
-  author: Google LLC
-  last-updated: '2026-08-14'
-  keywords:
-  - recipe
-  - Android
-  - Security
-  - Intent
-  - Redirection
-  - PendingIntent
-  - ContentProvider
-  - Service
-  - Signature
-  - Verification
-  - sanitizer
-  - Vulnerability
-  - Best Practices
----
+> Adapted from the `android-intent-security` skill in [android/skills](https://github.com/android/skills) (Apache-2.0). See `THIRD_PARTY_NOTICES.md`.
 
 This skill provides guidelines and patterns to secure Android components
 (Activities, Services, Broadcast Receivers, Content Providers) and handle

package/skills/mobile-security/references/android.md

@@ -0,0 +1,37 @@
+# Android security checks
+
+Apply after the general checks in `SKILL.md`, to native Android apps and to the `android/` folder of cross-platform apps. For a deep review of exported components, intents, `PendingIntent`s and intent redirection, follow [android/intent-security.md](android/intent-security.md).
+
+## Manifest and components
+
+- [ ] `activity`, `service`, `receiver` or `provider` with `android:exported="true"` without a permission and without validating the incoming `Intent`.
+- [ ] `android:debuggable="true"` hardcoded in the manifest.
+- [ ] `android:allowBackup="true"` (or absent) in an app with sensitive data, without backup and data extraction rules that exclude it.
+- [ ] `PendingIntent`s created mutable without need, or with implicit base intents.
+- [ ] App links without `android:autoVerify="true"` and a published Digital Asset Links file, so other apps can claim the same URLs.
+
+## Network
+
+- [ ] `android:usesCleartextTraffic="true"`, or a `network_security_config` with `cleartextTrafficPermitted="true"` for production domains.
+- [ ] `network_security_config` trusting user-installed certificates (`<certificates src="user"/>`) outside `debug-overrides`.
+- [ ] A custom `TrustManager` or `HostnameVerifier` that accepts everything.
+
+## Storage and credentials
+
+- [ ] Tokens in `SharedPreferences` or DataStore without encryption. Keep keys in the Android Keystore; Jetpack Security (`EncryptedSharedPreferences`) is deprecated, so check the current recommendation before introducing it.
+- [ ] Keystore passwords in a committed `build.gradle(.kts)` instead of `key.properties` or environment variables.
+- [ ] `BiometricPrompt` used without a `CryptoObject` when it protects credentials.
+
+## UI and logs
+
+- [ ] Screens with sensitive data without `WindowManager.LayoutParams.FLAG_SECURE`, which blocks screenshots and the recents thumbnail.
+- [ ] `Log.d`/`Log.v` with sensitive data not stripped in release (R8 rules or a logging wrapper).
+
+## WebView
+
+- [ ] `setJavaScriptEnabled(true)` with `addJavascriptInterface` on content the app does not control.
+- [ ] `setAllowFileAccess(true)` or universal access from file URLs enabled.
+
+## Release
+
+- [ ] R8 disabled (`isMinifyEnabled = false`) for release when the app has logic worth protecting.

package/skills/{flutter-secure-token-store/SKILL.md → mobile-security/references/flutter/secure-token-store.md}

@@ -1,11 +1,4 @@
----
-name: flutter-secure-token-store
-description: "Stores JWT access tokens on Flutter with platform secure storage (Keychain on iOS, Keystore-backed storage on Android) via flutter_secure_storage. Use when persisting, reading or clearing auth tokens, or when replacing shared_preferences token storage."
-intents: [security]
-stacks: [flutter]
----
-
-# flutter-secure-token-store
+# Storing auth tokens securely in Flutter
 
 ## Description
 Store JWT tokens securely on Flutter using platform secure storage.

package/skills/mobile-security/references/flutter.md

@@ -0,0 +1,30 @@
+# Flutter security checks
+
+Apply after the general checks in `SKILL.md`. The native folders (`android/`, `ios/`) also get [android.md](android.md) and [ios.md](ios.md).
+
+## Storage
+
+- [ ] Tokens in `shared_preferences`, `hive` or `sqflite` without encryption. Use `flutter_secure_storage`, which stores values in the Keychain on iOS and Keystore-backed storage on Android: [flutter/secure-token-store.md](flutter/secure-token-store.md).
+- [ ] Sensitive data cached in plain files under the app documents directory.
+
+## Network
+
+- [ ] `HttpClient.badCertificateCallback` returning `true`, or `HttpOverrides.global` disabling validation: Critical if it reaches the release build.
+- [ ] `dio` or `http` clients built with custom certificate handling that accepts everything outside debug.
+
+## Secrets and logs
+
+- [ ] `print`/`debugPrint`/`log` with a token, `Authorization` header or login payload; `dio`'s `LogInterceptor` enabled in release.
+- [ ] Secrets passed with `--dart-define` or `--dart-define-from-file` and treated as safe: they end up in the binary.
+
+## Release hardening
+
+- [ ] Release builds without `--obfuscate --split-debug-info=<dir>` when the app needs obfuscation. Keep the split debug info to symbolicate crashes.
+- [ ] `kDebugMode`-only checks that also guard security behavior, so the check disappears in release.
+
+## Platform
+
+- [ ] `webview_flutter` with `JavaScriptMode.unrestricted` and `addJavaScriptChannel` loading URLs the app does not control.
+- [ ] Deep links (`go_router`, `app_links`, `uni_links`) that navigate to privileged screens or perform actions without validating parameters and authentication.
+- [ ] Platform channels that expose native capabilities (files, keychain, device identifiers) to any Dart caller without validating arguments.
+- [ ] Biometric login with `local_auth` that only returns a boolean; bind it to a key stored behind biometric protection when it guards credentials.

package/skills/mobile-security/references/ios.md

@@ -0,0 +1,27 @@
+# iOS security checks
+
+Apply after the general checks in `SKILL.md`, to native iOS apps and to the `ios/` folder of cross-platform apps.
+
+## Network
+
+- [ ] `NSAppTransportSecurity` with `NSAllowsArbitraryLoads = true` in `Info.plist` without a justified per-domain exception.
+- [ ] A `URLSessionDelegate` that accepts any `serverTrust` without evaluating it.
+
+## Storage and credentials
+
+- [ ] Tokens in `UserDefaults`, property lists or files instead of the Keychain.
+- [ ] Keychain items with permissive accessibility (`kSecAttrAccessibleAlways*`, deprecated) instead of `...WhenUnlocked` or `...AfterFirstUnlock`; `ThisDeviceOnly` variants for secrets that must not migrate to other devices through backups.
+- [ ] Files with sensitive data written without an appropriate Data Protection class.
+- [ ] Biometrics checked with `LAContext.evaluatePolicy` only as a boolean when they guard credentials; protect the Keychain item with `SecAccessControl` and biometry instead.
+
+## Platform
+
+- [ ] Custom URL schemes performing actions without validation; any app can register the same scheme. Prefer universal links for sensitive flows.
+- [ ] Screens with sensitive data without protection in the app switcher snapshot (cover the content when the scene moves to the background).
+- [ ] Sensitive data copied to `UIPasteboard.general` without an expiration or local-only option.
+- [ ] `WKWebView` loading remote content with `WKScriptMessageHandler`s that perform privileged actions.
+
+## Logs and privacy
+
+- [ ] `NSLog`, `print` or `os_log` with sensitive data; `os_log`/`Logger` values that should be private must not be marked public.
+- [ ] Missing or inaccurate privacy manifest (`PrivacyInfo.xcprivacy`) for the app and third-party SDKs that use required-reason APIs or collect data; check Apple's current requirements.

package/skills/mobile-security/references/react-native.md

@@ -0,0 +1,29 @@
+# React Native security checks
+
+Apply after the general checks in `SKILL.md`. The native folders (`android/`, `ios/`) and native modules also get [android.md](android.md) and [ios.md](ios.md).
+
+## Storage
+
+- [ ] Tokens or credentials in `AsyncStorage` or MMKV without encryption. Use the Keychain/Keystore through `react-native-keychain` or `expo-secure-store`.
+
+## Secrets in the bundle
+
+- [ ] Secrets in `.env` files read through `react-native-config`, `babel` env plugins or `EXPO_PUBLIC_*` variables: they are inlined into the JavaScript bundle and readable in the APK or IPA.
+- [ ] Secrets in `app.json`/`app.config.*` `extra`, which is bundled into the app.
+- [ ] Hermes bytecode treated as protection: it is not obfuscation, and the bundle can be decompiled.
+
+## Network
+
+- [ ] `http://` endpoints allowed through native exceptions added for development and left in release (see the native references).
+- [ ] Certificate pinning libraries configured with a single pin and no rotation plan.
+
+## Platform
+
+- [ ] `react-native-webview` with `originWhitelist={['*']}` and an `onMessage` handler that performs actions, or `injectedJavaScript` exposing tokens to remote content.
+- [ ] Deep links handled through `Linking` or the navigation linking config without validating origin and parameters.
+- [ ] Native modules exposing sensitive capabilities to JavaScript without validating arguments.
+
+## Logs and updates
+
+- [ ] `console.log` with sensitive data not removed in release builds (for example with `babel-plugin-transform-remove-console`).
+- [ ] Over-the-air updates (`expo-updates` or other services) without code signing, so a compromised update channel can ship arbitrary JavaScript. Check whether the update service used supports signing and whether it is enabled.

package/skills/mobile-security-audit/SKILL.md

@@ -1,101 +0,0 @@
----
-name: mobile-security-audit
-description: Security audit for mobile apps based on the OWASP MASVS categories — insecure token storage, hardcoded secrets, cleartext traffic, TLS validation bypass, exported components, WebView exposure, sensitive logging and release hardening — with concrete checks for Flutter, Android, iOS and React Native. Use when reviewing mobile code, auditing app security, handling authentication or tokens, or preparing a release.
-intents: [review, security, release]
-stacks: ["*"]
----
-
-# Mobile Security Audit
-
-Organized by the OWASP MASVS categories. Apply the general section and then the one for the detected stack (in cross-platform apps, also apply Android and iOS to the native folders).
-
-Every finding needs evidence in the code or configuration. Severity:
-
-- **Critical:** exposed credential or sensitive data, TLS validation disabled, exported component that performs a privileged action.
-- **High:** token in insecure storage, cleartext traffic to the API, WebView with a JavaScript bridge exposed to remote content.
-- **Medium/Low:** missing hardening, verbose logs, backup enabled without need.
-
-## General (all stacks)
-
-**MASVS-STORAGE**
-- [ ] Access token, refresh token and personal data kept in insecure storage (preferences, files, unencrypted database).
-- [ ] Sensitive data in logs, analytics or crash reports.
-
-**MASVS-CRYPTO**
-- [ ] Private API keys, client secrets, signing keys or passwords in source code, assets or bundled configuration files. Everything shipped in the app can be extracted; a real secret stays on the backend.
-- [ ] Homemade cryptography, fixed IV/key, MD5/SHA-1 for passwords.
-
-**MASVS-AUTH**
-- [ ] Authorization decided only on the client (local `isAdmin` flag, hiding a button as access control).
-- [ ] Session without expiration or refresh token never invalidated on logout.
-- [ ] Biometrics used only as a local boolean, without binding to a cryptographic key.
-
-**MASVS-NETWORK**
-- [ ] `http://` URLs for APIs.
-- [ ] Certificate validation disabled.
-- [ ] Pinning, if present, without a rotation strategy (single pin with no backup).
-
-**MASVS-PLATFORM**
-- [ ] Deep links and universal links that perform actions without validating parameters or without authentication.
-- [ ] WebView loading remote content with JavaScript and a native bridge enabled.
-- [ ] Sensitive data on the clipboard or visible in the app switcher snapshot.
-
-**MASVS-CODE / RESILIENCE**
-- [ ] Release build without obfuscation/minification when the app has sensitive logic.
-- [ ] Debug code or endpoints reachable in release.
-
-**MASVS-PRIVACY**
-- [ ] Permissions requested without real use in the code.
-- [ ] Third-party SDKs collecting undeclared data (Privacy Manifest on iOS, Data safety on the Play Store).
-
-## Flutter
-
-- [ ] Tokens in `shared_preferences`, `hive` or `sqflite` without encryption: use `flutter_secure_storage` (Keychain/Keystore).
-- [ ] `HttpClient.badCertificateCallback` returning `true` or `HttpOverrides.global` disabling validation: Critical if it reaches the release build.
-- [ ] `print`/`debugPrint`/`log` with a token, `Authorization` header or login payload. `dio` interceptors with `LogInterceptor` active in release.
-- [ ] Secrets passed via `--dart-define` and treated as safe: they end up in the binary.
-- [ ] Release build without `--obfuscate --split-debug-info` when the app needs obfuscation.
-- [ ] `webview_flutter` with `JavaScriptMode.unrestricted` and `addJavaScriptChannel` loading an uncontrolled URL.
-
-## Android (Kotlin/Java, or `android/` in cross-platform apps)
-
-- [ ] `AndroidManifest.xml`: `android:usesCleartextTraffic="true"` or `network_security_config` with `cleartextTrafficPermitted="true"` for production domains.
-- [ ] `network_security_config` trusting user certificates (`<certificates src="user"/>`) in release.
-- [ ] `android:allowBackup="true"` (or absent) in an app with sensitive data, without exclusion rules.
-- [ ] `activity`/`service`/`receiver`/`provider` with `android:exported="true"` without a permission and without validating the `Intent`.
-- [ ] `android:debuggable="true"` hardcoded in the manifest.
-- [ ] Tokens in `SharedPreferences` without encryption.
-- [ ] `WebView` with `setJavaScriptEnabled(true)` + `addJavascriptInterface` or `setAllowFileAccess(true)`.
-- [ ] Custom `TrustManager`/`HostnameVerifier` that accepts everything.
-- [ ] `Log.d`/`Log.v` with sensitive data not stripped in release (R8 rules or a log wrapper).
-- [ ] Keystore passwords in a committed `build.gradle` instead of `key.properties`/environment variables.
-
-## iOS (Swift/Objective-C, or `ios/` in cross-platform apps)
-
-- [ ] `Info.plist`: `NSAppTransportSecurity` with `NSAllowsArbitraryLoads = true` without a justified per-domain exception.
-- [ ] Tokens in `UserDefaults` or files instead of the Keychain.
-- [ ] Keychain items with permissive accessibility (`kSecAttrAccessibleAlways*`, already deprecated) instead of `...WhenUnlocked`/`...AfterFirstUnlock`.
-- [ ] `URLSessionDelegate` accepting any `serverTrust` without evaluating it.
-- [ ] Custom URL schemes performing actions without validation (prefer universal links).
-- [ ] `NSLog`/`print` with sensitive data.
-- [ ] Screen with sensitive data without snapshot protection when going to background.
-
-## React Native
-
-- [ ] Tokens in `AsyncStorage`: use Keychain/Keystore (`react-native-keychain`, `expo-secure-store`).
-- [ ] `.env` via `react-native-config`/`expo-constants` with secrets: they go into the JS bundle, readable in the APK/IPA.
-- [ ] `react-native-webview` with `originWhitelist={['*']}` and `onMessage` performing actions.
-- [ ] `console.log` with sensitive data not stripped in release (for example, `babel-plugin-transform-remove-console`).
-- [ ] Deep links handled in `Linking` without validating origin and parameters.
-
-## Useful commands (read-only)
-
-```bash
-git ls-files | grep -Ei '\.(jks|keystore|p12|p8|mobileprovision|env)$|key\.properties|google-services\.json|GoogleService-Info\.plist'
-grep -rn --include='*.xml' -E 'usesCleartextTraffic|allowBackup|exported="true"|debuggable' android app 2>/dev/null
-grep -rn -E 'NSAllowsArbitraryLoads' --include='*.plist' . 2>/dev/null
-```
-
-## Output
-
-Report under **Security** (or **Critical**, when the severity is Critical), with the MASVS category, `file:line`, impact and fix.