Sensitive data is encrypted at rest using platform-secure storage

AsyncStorage in React Native is unencrypted plaintext on every platform — its contents are readable from a jailbroken iOS device or from any app on Android versions below 4.4. Storing auth tokens, JWTs, or user PII in AsyncStorage means a single compromised device exposes session credentials that can be replayed to impersonate the user with full account access. OWASP 2021 A02 (Cryptographic Failures), CWE-312 (Cleartext Storage of Sensitive Information), HIPAA §164.312(a)(2)(iv), and NIST SP 800-218 PW.4 all require sensitive data at rest to be encrypted using platform-provided mechanisms (Keychain on iOS, Keystore on Android).

Replace AsyncStorage for sensitive data with expo-secure-store, which uses Keychain on iOS and EncryptedSharedPreferences on Android:

import * as SecureStore from 'expo-secure-store';

// Store
await SecureStore.setItemAsync('authToken', token);

// Retrieve
const token = await SecureStore.getItemAsync('authToken');

For non-Expo React Native, use react-native-keychain:

import * as Keychain from 'react-native-keychain';
await Keychain.setGenericPassword('token', jwtValue);

Search for every AsyncStorage.setItem call in src/ and audit what is being stored. Move tokens and PII to secure storage; leave only non-sensitive preferences (theme, language) in AsyncStorage.