Database encrypted (SQLite encryption or equivalent)

A plaintext SQLite database file is readable by anyone with filesystem access to the device — a physical attacker, a forensic tool, or malware with elevated privileges. CWE-311 (Missing Encryption of Sensitive Data) and CWE-922 (Insecure Storage of Sensitive Information) both apply. OWASP Mobile Top 10 M9 and GDPR Art. 32 require encryption for stored personal data. Unlike AsyncStorage, a SQLite file is a structured, easily-parsed binary that can be opened in any standard tool. A single extracted database file exposes the entire local data model with no further attack required.

Enable database-level encryption using SQLCipher, MMKV's built-in encryption, or Realm's encryption configuration. Derive the encryption key from platform-secure storage — never hardcode it.

// MMKV with encryption (npm install react-native-mmkv)
import { MMKVLoader } from 'react-native-mmkv';

const storage = new MMKVLoader()
  .setEncryption(true)
  .initialize();

// Realm with encryption (npm install realm)
import Realm from 'realm';
import * as SecureStore from 'expo-secure-store';

async function openEncryptedRealm() {
  const keyHex = await SecureStore.getItemAsync('realm_key');
  const encryptionKey = hexToUint8Array(keyHex!);
  return Realm.open({
    schema: [YourSchema],
    encryptionKey,  // 64-byte Uint8Array
  });
}

Store the database encryption key in expo-secure-store or Keychain — not in source code and not in AsyncStorage. Rotate the key on first launch if none exists.