# 5 Places Sensitive Data Leaks in a React Native App (and How to Plug Them)

> Source: <https://dev.to/russel_dsouza_bd584a3cb2a/5-places-sensitive-data-leaks-in-a-react-native-app-and-how-to-plug-them-3gf1>
> Published: 2026-07-21 07:49:01+00:00

`AsyncStorage.setItem`

near `token`

, and `console.log(user`

/ `console.log(token`

/ `console.log(prompt`

.Data protection posts usually focus on the shipped binary. Encrypt this, pin that certificate, wrap the API client. All correct, all necessary — and all too late if the leak happened three weeks earlier in a design mockup.

We build AI-generated React Native apps at RapidNative, and the interesting security bugs almost never live in production code. They live in the space between code, design, and AI workflows. Here are five leak points we've watched teams miss.

The classic. `AsyncStorage`

is convenient, unencrypted key-value storage. A user session token in AsyncStorage is one rooted device or one iCloud backup extraction away from being replayed.

**Fix:** use `expo-secure-store`

(Keychain on iOS, Keystore on Android) for anything that unlocks an account.

```
import * as SecureStore from 'expo-secure-store';

export async function saveSessionToken(token) {
  await SecureStore.setItemAsync('session_token', token);
}
```

If your codebase greps positive for `AsyncStorage.setItem`

and `token`

, that's your first PR.

A designer opens Figma, needs a realistic list, and pastes 20 rows from the production customer export. Now customer names sit in the design file, which sits in a Figma team folder, which was shared to a contractor's personal email nine months ago.

**Fix:** a synthetic data script committed to the repo. `npx generate-mocks users 20`

should be faster than exporting production data. Make the fast path the safe path.

Voice memo lands. Transcription service returns text. A second model extracts tasks. Teammates get pinged.

That's four handoffs, and the security review probably only covers the API endpoint at step 1.

**Fix:** draw the pipeline as boxes, list what data each box sees, and confirm each hop has access controls tied to the user's actual consent — not a bundle. Camera consent is not AI-summarization consent.

Sentry, Bugsnag, Datadog, or whatever log aggregator you use sees everything the app hands it. Session tokens in `Authorization`

headers. AI prompt bodies with user text. Full user IDs in breadcrumbs.

**Fix:** scrub before you send. Most SDKs support a `beforeSend`

hook.

```
Sentry.init({
  beforeSend(event) {
    if (event.request?.headers) delete event.request.headers.Authorization;
    return event;
  },
});
```

Grep your codebase for `console.log(user`

, `console.log(token`

, and `console.log(prompt`

. That's your second PR.

You ask for camera on onboarding: "we need this for document capture." The user agrees. Six months later a new AI-summarization feature ships that also uses camera frames.

Same permission, different purpose. Legally shaky (GDPR Article 25 asks for data minimization by design), and practically a betrayal of what the user thought they said yes to.

**Fix:** model consent as a first-class type, keyed on purpose rather than on OS permission:

```
type ConsentEvent = {
  userId: string;
  action: 'granted' | 'withdrawn';
  policyVersion: string;
  purpose: 'document-capture' | 'ai-summary' | 'marketing';
  surface: 'onboarding' | 'settings' | 'feature-gate';
  timestamp: string;
};
```

Ship a new feature, ask again for that purpose. A one-line inconvenience for the user beats the €7.1B in GDPR fines the EU has issued as of January 2026.

Notice what the five have in common: none of them are broken TLS, weak crypto, or a mangled JWT signature. They're all **workflow leaks**.

Encryption and pinning are table stakes. The bugs that leak your customer's data in 2026 are the ones nobody put in the security review — because they happen in Figma, in a Slack DM, in a Sentry payload, or in an AI pipeline diagram that was never drawn.

Draw the diagram. Grep the logs. Model consent. Ship.

Full source with the OWASP and NIST references: [rapidnative.com/blogs/data-protection](https://rapidnative.com/blogs/data-protection?utm_source=devto&utm_medium=blog&utm_campaign=data-protection).

Which of the five would your codebase fail right now? Mine failed #4 the first time I checked.