Expo pre-launch checklist
Defaults referenced come from Expo's documentation, verified 2026-09-21, on the Expo hub.
Secrets and keys
- CriticalSecrets committed to the code repository
Open your project on GitHub (or the code view in your builder) and look at the file list for
.env,.env.local,.env.production,serviceAccountKey.jsonorfirebase-adminsdkfiles. - HighThird-party API key in the JavaScript bundle
Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
Data access
- CriticalRecord ids accepted without an ownership check
Create two accounts in your app and add one record, such as an order or a note, in each.
Login and permissions
- CriticalAuthorization enforced only in the browser
Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
AI features
- CriticalLLM API key exposed to the client
Open your live app, press F12, select the Network tab, and use the AI feature once.
Mobile
- CriticalSecrets in the mobile app bundle
Open the project's .env files and app.json or app.config.js; list every variable whose name starts with EXPO_PUBLIC_ or that sits under extra.
- HighOffline state corrupting data
On two phones (or a phone and the simulator) signed into the same account, put one in airplane mode and edit the same record on both.
- MediumCertificate pinning absent
Search the project for pinning-related words: pin, sha256, certificate, network_security_config, NSPinnedDomains, trustkit.
Payments
- HighSubscription state trusted from local storage
Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
Reliability
- HighNo rate limiting on sensitive routes
Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
- MediumErrors swallowed, spinner never stops
Open your app in Chrome and sign in as a normal user.
- MediumRetries with no pause and no cap
Open your app in Chrome, press F12 and choose the Network tab.
Deploy and config
- HighDependencies with known vulnerabilities
If your builder shows a package.json file or lets you export the code, open a terminal in that folder and run npm audit (or pnpm audit or yarn audit).
Performance
- MediumList endpoints that return everything
Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
- MediumWhole table downloaded, filtered in the browser
Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
Questions
expo security checklist
The list above: 15 checks across 9 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.
can i use this checklist without buying anything
Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.
Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.