React Native Security

@ansight/react-native bridges to the native iOS and Android SDKs. Secure the JavaScript package, the native package integrations, and the runtime options together.

Package Scope

Install @ansight/react-native only in app variants that are allowed to use Ansight. The package brings native SDK dependencies through CocoaPods on iOS and Maven on Android.

For public release builds, omit the package where possible. If the package remains present in an internal release-like build, disable tool discovery and execution at runtime and avoid bundling developer pairing payloads.

Runtime Guard

Use the app’s own development-only condition to decide whether to apply native all-in-one defaults. Keep a deny-all guard when that condition is false.

import Ansight from "@ansight/react-native";

const isDevelopmentOnly = __DEV__;

const builder = Ansight.createOptionsBuilder();

if (isDevelopmentOnly) {
  builder.withNativeAllInOneDefaults().withReadOnlyToolAccess();
} else {
  builder.withToolsDisabled();
}

const options = builder.build();

await Ansight.initializeAndActivate(options);

Use "readWrite" or "fullAccess" only for workflows that need mutation or delete-scoped native tools.

Native Tool Suites

React Native exposes native file, database, preferences, reflection, secure-storage, and optional VisualTree tools through bridge options. Keep each suite intentional:

const options = Ansight.createOptionsBuilder()
  .withReadOnlyToolAccess()
  .withDatabaseTools({ includePlatformRoots: true })
  .withFileSystemTools({
    additionalRoots: [{ alias: "exports", path: "/tmp/app-exports" }],
  })
  .build();

VisualTree is opt-in with withVisualTreeTools() because it exposes native hierarchy and screenshots.

Pairing Payloads

Do not commit or ship developer pairing configs:

ansight.json
*.ans.json
ansight.developer-pairing.json

If you pass hostConnection.bundledDeveloperConfigJson, source it from developer-only native build configuration, local assets, or a non-public environment. Do not hard-code signed pairing payloads in JavaScript that ships publicly.

If a developer must reuse a pairing config on-device, prefer syncing or importing the signed config at runtime into app-owned native secure storage, then reading it into the React Native bridge from that secure store. Avoid placing long-lived pairing JSON in JavaScript bundles, Metro env values, native resources, or distributable build artifacts.

Platform Permissions

The native app still owns iOS and Android permissions:

• iOS local network pairing or discovery needs NSLocalNetworkUsageDescription.
• iOS QR pairing needs NSCameraUsageDescription only when QR scanning is exposed.
• Android host connection needs INTERNET and ACCESS_NETWORK_STATE.
• Android QR pairing needs CAMERA only when QR scanning is exposed.

Do not add broad network, camera, or cleartext settings unless the app integration requires them.

JavaScript And Native Custom Tools

JavaScript custom tools use Ansight.registerTool(...); native custom tools use Swift or Kotlin runtime registration. Both share the same global tool namespace and guard policy.

Use narrow app-owned ids, validate all string arguments, and keep mutation or destructive behavior out of public builds.

Sensitive Data

React Native sessions can include native screenshots, touch input, app logs, JavaScript-backed React inspection data, native memory telemetry, file contents, database rows, preferences, secure-storage values, and custom tool results.

Use test accounts, keep captures local, and remove stale sessions and pairing configs when they are no longer needed.