Keychain/Keystore used for sensitive data storage

Platform secure storage (iOS Keychain, Android Keystore) is backed by hardware security modules on modern devices — credentials stored there cannot be extracted even with root access because the decryption key never leaves the secure enclave. CWE-312 (Cleartext Storage of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials) both apply when an app stores tokens outside these APIs. OWASP A02 and NIST SC-28 require encryption at rest for all authentication credentials. Apps without Keychain/Keystore usage have no encrypted credential store by definition — every stored secret is as secure as the device filesystem, which is not secure at all on rooted or cloned devices. This is the class of vulnerability that drives credential-stuffing campaigns after device theft.

Ensure every sensitive value flows through expo-secure-store or native Keychain/Keystore. Audit all storage calls and confirm zero sensitive values in AsyncStorage, MMKV, or localStorage.

// Expo (wraps Keychain on iOS, EncryptedSharedPreferences on Android)
import * as SecureStore from 'expo-secure-store'

async function storeSession(token: string, userId: string) {
  await SecureStore.setItemAsync('session_token', token)
  await SecureStore.setItemAsync('user_id', userId)
}

async function clearSession() {
  await SecureStore.deleteItemAsync('session_token')
  await SecureStore.deleteItemAsync('user_id')
}

For bare React Native, use react-native-keychain: Keychain.setGenericPassword(username, password). For large encrypted blobs, use react-native-mmkv with an encryption key stored in Keychain — not a hardcoded key.