Deep link parameters are validated before use

Unvalidated deep link parameters are the mobile equivalent of SQL injection — an attacker crafts a URL like myapp://product?id=../../admin and your app executes database queries or navigation logic against that raw string. OWASP A03 (Injection) and CWE-20 (Improper Input Validation) both target exactly this pattern. A product ID that arrives as "../config" and lands directly in a fetch call exposes data that the user was never meant to see. Beyond security, invalid parameters crash screens and generate unhandled exceptions that are reported to production crash tracking.

Validate every parameter from route.params at the screen boundary before it touches any data-fetching or navigation call. Use a Zod schema at the entry point so validation is explicit and type-safe:

import { z } from 'zod'
import { useRoute } from '@react-navigation/native'

const ParamsSchema = z.object({
  id: z.string().regex(/^\d+$/, 'ID must be numeric'),
})

function ProductDetailScreen() {
  const route = useRoute()
  const parsed = ParamsSchema.safeParse(route.params)

  if (!parsed.success) {
    return <ErrorScreen message="Invalid product ID" />
  }

  const productId = parseInt(parsed.data.id, 10)
  // safe to fetch
}

Apply this pattern to every screen that has a :param segment in its deep link definition — not just the ones you think are sensitive.