234
secure storage
also Keychain, Keystore
Tokens live in the keychain or the keystore. AsyncStorage is not a safe.
What is secure storage?
Secure storage is the OS credential store: iOS Keychain, Android Keystore, or EncryptedSharedPreferences backed by it. Items can require biometric unlock. They can survive reinstall depending on the accessibility flag. UserDefaults, SharedPreferences, and AsyncStorage are plaintext files.
Why does secure storage matter when vibe coding?
The draft saves the refresh token in AsyncStorage because the tutorial did. The backup includes it. A rooted device reads it. The word you needed was keychain.
How do you do secure storage?
Put credentials and keys in secure storage. Set the accessibility and backup flags on purpose. Do not log the value. Do not mirror it into a database “for convenience.”
How do you ask a model for secure storage?
Store (token) in the Keychain or Keystore, not AsyncStorage or UserDefaults. Do not back it up to cloud storage. Do not log it. Require biometric unlock only if (feature) needs it.
What goes wrong with secure storage?
A keychain item that survives logout because nobody deleted it. The next user on a shared device inherits the session.