Sensitive permissions use proper permission API

Accessing device hardware through undocumented native paths instead of the platform's official permission API means the app bypasses the OS-level permission gate entirely. OWASP Mobile Top 10 A01 (Improper Credential Usage) includes improper access to device hardware as a credential misuse vector. CWE-272 (Least Privilege Violation) is directly triggered when an app reads from a sensor without first verifying it has been granted access. Beyond correctness, bypassing react-native-permissions or expo-permissions means your code will behave unpredictably when users revoke permissions mid-session, because the native module has no revocation-aware wrapper — the call will silently fail or crash instead of returning a denied status.

Replace direct native module calls with react-native-permissions (bare React Native) or expo-permissions / expo-location (Expo). Always distinguish between LOCATION_WHEN_IN_USE and LOCATION_ALWAYS.

import { request, PERMISSIONS, RESULTS } from 'react-native-permissions'
import { Platform } from 'react-native'

async function requestLocationPermission(): Promise<boolean> {
  const permission =
    Platform.OS === 'ios'
      ? PERMISSIONS.IOS.LOCATION_WHEN_IN_USE
      : PERMISSIONS.ANDROID.ACCESS_FINE_LOCATION

  const result = await request(permission)
  return result === RESULTS.GRANTED
}

For Expo, use the typed exports from expo-location, expo-camera, or expo-contacts — they wrap the same Keychain/Keystore-aware permission APIs and handle revocation correctly.