How can we stop a hacker from reverse engineering a react-native app ?

[gourav-singhal]

• Review the documentation: https://facebook.github.io/react-native
• Search for existing issues: https://github.com/facebook/react-native/issues
• Use the latest React Native release: https://github.com/facebook/react-native/releases

Environment

React Native Environment Info:
System:
OS: macOS High Sierra 10.13.6
CPU: x64 Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Memory: 844.41 MB / 12.00 GB
Shell: 3.2.57 - /bin/bash
Binaries:
Node: 10.8.0 - /usr/local/bin/node
npm: 6.2.0 - /usr/local/bin/npm
Watchman: 4.9.0 - /usr/local/bin/watchman
SDKs:
iOS SDK:
Platforms: iOS 11.4, macOS 10.13, tvOS 11.4, watchOS 4.3
Android SDK:
Build Tools: 23.0.1, 23.0.3, 25.0.2, 26.0.0, 26.0.1, 26.0.2, 26.0.3, 27.0.0, 27.0.2, 27.0.3, 28.0.0
API Levels: 23, 25, 26, 27
IDEs:
Android Studio: 3.0 AI-171.4443003
Xcode: 9.4.1/9F2000 - /usr/bin/xcodebuild
npmPackages:
react: 16.6.1 => 16.6.1
react-native: 0.57.7 => 0.57.7
npmGlobalPackages:
react-native-cli: 2.0.1
react-native-fetch-blob: 0.10.8
react-native-mail: 3.0.6

Description

Hi All,

Can you suggest the best practices to store sensitive information in a react-native app?

Currently I have my api_keys and other sensitive information in a config.js file which could be easily read using reverse engineering techniques.

Reproducible Demo

This issue is related to any react native project build as all the code is minified in a mainbundle.js file which can be easily opened in any text editor.

[react-native-bot]

It looks like you are using an older version of React Native. Please update to the latest release, v0.57 and verify if the issue still exists.

The "⏪Old Version" label will be removed automatically once you edit your original post with the results of running react-native info on a project using the latest release.

[gourav-singhal]

Yes the issue exists in latest version as well updated original post

[gourav-singhal]

#1093

[hramos]

This issue repository is for tracking bugs in the React Native SDK. Can you post your question to one of the other community forums instead?