No sensitive data stored in device shared preferences or NSUserDefaults

AsyncStorage on React Native is unencrypted, stored in plaintext on the device filesystem, and accessible to any process with root access or via backup extraction on Android. Storing auth tokens, API keys, or PII in AsyncStorage violates GDPR Art. 32 (security of processing) and NIST SP 800-53 SC-28 (protection of information at rest). On a jailbroken iOS device or a rooted Android device — which a meaningful fraction of users run — the AsyncStorage database file is readable without authentication. OWASP Mobile Top 10 A02 (Insecure Data Storage) lists unencrypted AsyncStorage for tokens as a critical vulnerability. A compromised auth token allows full account takeover; a compromised API key enables billing fraud.

Move all auth tokens, API keys, and PII from AsyncStorage to expo-secure-store (Expo) or native Keychain/Keystore. Restrict AsyncStorage to non-sensitive preferences only.

import * as SecureStore from 'expo-secure-store'
import AsyncStorage from '@react-native-async-storage/async-storage'

// Sensitive: use SecureStore (encrypted, Keychain-backed on iOS)
await SecureStore.setItemAsync('authToken', token)
await SecureStore.setItemAsync('refreshToken', refreshToken)

// Non-sensitive only: use AsyncStorage
await AsyncStorage.setItem('colorScheme', 'dark')
await AsyncStorage.setItem('lastViewedTab', 'home')

Search for AsyncStorage.setItem calls with keys like token, auth, key, password, email, or user — those are the most common violations. SecureStore keys are bounded at 2048 bytes; store a reference ID and fetch larger payloads from an encrypted database if needed.