Storage usage within reasonable limits
Why it matters
An app with no storage quotas or cleanup logic accumulates cache data indefinitely. On devices with limited storage — a real constraint on mid-range and older Android handsets — this causes the OS to terminate the app, deny further writes, or prompt the user to clear data. ISO 25010:2011 performance-efficiency.resource-utilisation requires that apps bound their resource footprint. Beyond the device-health impact, unbounded storage growth retains data that should have been evicted: stale records, orphaned queue items, and superseded cache entries that inflate the attack surface for physical device compromise.
Severity rationale
Low because storage accumulation degrades device health and UX over time rather than enabling immediate exploitation, but it becomes a reliability defect on constrained devices.
Remediation
Implement a storage quota check and an LRU or age-based eviction function. Call the eviction function on app launch and after any large batch write.
import AsyncStorage from '@react-native-async-storage/async-storage';
const SOFT_LIMIT_BYTES = 50 * 1024 * 1024; // 50 MB
export async function storageUsageBytes(): Promise<number> {
const keys = await AsyncStorage.getAllKeys();
const pairs = await AsyncStorage.multiGet(keys);
return pairs.reduce((sum, [, v]) => sum + (v?.length ?? 0), 0);
}
export async function evictOldCache(maxAgeDays = 7) {
const cutoff = Date.now() - maxAgeDays * 86_400_000;
const keys = await AsyncStorage.getAllKeys();
const cacheKeys = keys.filter(k => k.startsWith('cache_'));
const stale = cacheKeys.filter(k => {
const ts = parseInt(k.split('_').pop() ?? '0', 10);
return ts < cutoff;
});
if (stale.length) await AsyncStorage.multiRemove(stale);
}
// On app launch:
const used = await storageUsageBytes();
if (used > SOFT_LIMIT_BYTES) await evictOldCache(3); // tighten window under pressure
Apply the same eviction logic to offline queue entries older than 30 days — a queued action that old is almost certainly no longer relevant.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Offline & Storage Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency.resource-utilization — Resource Utilisation
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-offline-storage·automated