React Native Risk Assessment & Management 2 — Questions and Answers
Question 1: Which tool is commonly used to audit React Native project dependencies for known security vulnerabilities?
- npm audit (Correct answer)
- react-native doctor
- expo diagnostics
- yarn check
Correct answer: npm audit
`npm audit` scans the dependency tree against the npm advisory database and reports known CVEs.
Question 2: A React Native app stores JWT tokens in AsyncStorage. What is the primary security risk?
- Tokens are readable by other apps on jailbroken/rooted devices (Correct answer)
- AsyncStorage has a 6 MB size limit that tokens exceed
- JWT tokens cannot be serialized to strings
- AsyncStorage is wiped on every app restart
Correct answer: Tokens are readable by other apps on jailbroken/rooted devices
AsyncStorage is unencrypted and accessible on compromised devices, making it unsuitable for sensitive credentials.
Question 3: Which React Native risk is introduced when upgrading to a new major version without a migration guide?
- Breaking API changes can silently fail at runtime (Correct answer)
- Metro bundler automatically downgrades incompatible packages
- Native modules are always backwards-compatible
- JavaScript thread performance degrades permanently
Correct answer: Breaking API changes can silently fail at runtime
Major version upgrades often include breaking changes that may not surface until runtime if native modules are not updated in sync.
Question 4: What risk does the `react-native-upgrade-helper` tool specifically help mitigate?
- Missing or incorrect native file changes during an RN version upgrade (Correct answer)
- JavaScript bundle size bloat after upgrades
- Expo SDK compatibility gaps
- Android ProGuard rule conflicts
Correct answer: Missing or incorrect native file changes during an RN version upgrade
The Upgrade Helper diffs the RN template between versions so developers can manually apply the correct native file changes.
Question 5: A third-party React Native library has not been updated in 18 months. Which risk assessment concern is MOST relevant?
- The library may not support new Android/iOS API levels or new RN architecture (Correct answer)
- The library's JS bundle will be rejected by Metro
- The library cannot be linked with CocoaPods
- The library's README will be outdated
Correct answer: The library may not support new Android/iOS API levels or new RN architecture
Unmaintained libraries risk incompatibility with newer OS API levels, new RN architecture (Fabric/JSI), and security patches.
Question 6: Which strategy best mitigates the risk of a bad OTA (Over-The-Air) JavaScript update breaking production users?
- Staged rollouts with automatic rollback on crash-rate threshold (Correct answer)
- Disabling OTA updates entirely in production
- Requiring users to manually approve each update
- Using synchronous update checks on every app launch
Correct answer: Staged rollouts with automatic rollback on crash-rate threshold
Staged rollouts let you limit exposure, and automatic rollback based on crash rates limits blast radius if an update is broken.
Question 7: What is the risk of using `dangerouslySetInnerHTML` equivalent patterns in React Native WebView without sanitization?
- Cross-site scripting (XSS) attacks can execute arbitrary JavaScript in the WebView context (Correct answer)
- The WebView will crash due to invalid HTML parsing
- Metro will reject the bundle at build time
- iOS App Store will auto-reject the binary
Correct answer: Cross-site scripting (XSS) attacks can execute arbitrary JavaScript in the WebView context
Injecting unsanitized HTML/JS into a WebView creates an XSS attack surface that can exfiltrate data or manipulate the native bridge.
React Native Risk Assessment & Management 2
Which tool is commonly used to audit React Native project dependencies for known security vulnerabilities?