Build signing is configured

Code signing is the cryptographic mechanism that proves your binary was built by you and hasn't been tampered with in transit. Without a valid signing configuration, app stores refuse to accept the binary — there is no workaround or exception. For Android, releasing with only the debug keystore (the default development key) means you cannot update your app once published, because Google Play requires all updates to be signed with the same key. A lost or overwritten keystore permanently orphans your published app, blocking all future updates for every existing user. CWE-798 (hardcoded credentials) applies when keystore passwords appear in committed source — exposing your signing key allows anyone to publish malicious updates impersonating your app.

For Expo projects, use EAS Build which manages credentials automatically. For bare React Native Android, generate a release keystore and reference it via environment variables — never commit the keystore file or its password.

// android/app/build.gradle
signingConfigs {
  release {
    storeFile file(System.getenv("KEYSTORE_PATH") ?: "../release.keystore")
    storePassword System.getenv("KEYSTORE_PASSWORD")
    keyAlias System.getenv("KEYSTORE_ALIAS")
    keyPassword System.getenv("KEYSTORE_KEY_PASSWORD")
  }
}
buildTypes {
  release {
    signingConfig signingConfigs.release
  }
}

Store the keystore file and all four environment variables in your CI secret store (GitHub Actions secrets, EAS secrets, etc.). Back up the keystore in a separate secure location — it cannot be recovered if lost.