React Native Risk Assessment & Management 3 — Questions and Answers
Question 1: Which practice reduces the risk of supply-chain attacks when adding npm packages to a React Native project?
- Pinning exact dependency versions and using a lockfile committed to source control (Correct answer)
- Using the latest tag for all dependencies to get security patches automatically
- Installing only packages with more than 1,000 weekly downloads
- Disabling peer dependency warnings in npm config
Correct answer: Pinning exact dependency versions and using a lockfile committed to source control
Pinned versions and a committed lockfile prevent unexpected package updates that could introduce malicious code.
Question 2: A React Native app crashes on Android 12+ but works on older versions. What risk factor should be assessed first?
- New Android 12 behavioral changes (e.g., exact alarms, exported component flags) affecting native modules (Correct answer)
- JavaScript engine version incompatibility in the Metro bundler
- Hermes engine not supporting ES2021 syntax
- React Navigation version not supporting gesture handler
Correct answer: New Android 12 behavioral changes (e.g., exact alarms, exported component flags) affecting native modules
Android 12 introduced strict enforcement of manifest flags like `android:exported`, causing crashes in apps with unupdated native modules.
Question 3: What is the primary risk of not enabling Hermes in a production React Native app?
- Larger app startup time and increased memory usage compared to Hermes-optimized bytecode (Correct answer)
- The app will be rejected by the Apple App Store
- JavaScript debugging is permanently disabled
- ProGuard cannot minify the JS bundle
Correct answer: Larger app startup time and increased memory usage compared to Hermes-optimized bytecode
Without Hermes, JSC must parse and JIT-compile JavaScript at startup, increasing time-to-interactive and memory footprint.
Question 4: Which risk does enabling `android:allowBackup="true"` in a React Native Android app's manifest introduce?
- Sensitive app data including AsyncStorage can be extracted via ADB backup on non-rooted devices (Correct answer)
- The app will fail Google Play's target API level check
- Metro bundler cannot generate a valid APK
- Push notification tokens become invalidated on restore
Correct answer: Sensitive app data including AsyncStorage can be extracted via ADB backup on non-rooted devices
ADB backup can extract the app's data directory, exposing unencrypted AsyncStorage and SQLite databases on debug-enabled devices.
Question 5: What is the risk of calling `setState` inside a `useEffect` without a cleanup function when the component unmounts?
- Memory leak: React logs a warning and the state update targets an unmounted component (Correct answer)
- The effect will run synchronously before the render
- The component will re-render infinitely
- Metro hot reload will stop working
Correct answer: Memory leak: React logs a warning and the state update targets an unmounted component
Updating state on an unmounted component causes a memory leak and React warning; the returned cleanup cancels async operations.
Question 6: A React Native team ships a new feature without feature flags. What deployment risk does this create?
- There is no way to disable the feature for specific users without a new app release or OTA update (Correct answer)
- The JavaScript bundle will be split automatically by Metro
- TypeScript compilation will fail for flag-free code
- Android and iOS will receive different feature states
Correct answer: There is no way to disable the feature for specific users without a new app release or OTA update
Without feature flags, disabling a broken feature requires a full new release cycle or OTA update, delaying incident response.
Question 7: Which metric is MOST useful for assessing the risk of a React Native app's JavaScript bundle size on user retention?
- Time-to-interactive (TTI) on low-end devices with slow storage (Correct answer)
- Total lines of JavaScript source code
- Number of React components in the component tree
- Hermes bytecode output file count
Correct answer: Time-to-interactive (TTI) on low-end devices with slow storage
TTI on low-end devices directly correlates with user abandonment; large bundles increase I/O time before the app is usable.
React Native Risk Assessment & Management 3
Which practice reduces the risk of supply-chain attacks when adding npm packages to a React Native project?