What problem does it solve? An Ionic app inherits every web vulnerability plus a native attack surface the browser does not have: plaintext on-device storage, hijackable deep links, over-broad native permissions, and a debuggable WebView container. This Skill provides the security review map for that native layer so tokens, deep links, and release builds are hardened before an audit or ship. ## Core Features & Use Cases - Secret Storage Hardening: Enforces Keychain/Keystore-backed secure storage instead of plaintext Capacitor Preferences, localStorage, or IndexedDB, with explicit web-fallback degradation. - Deep Link and Permission Review: Treats deep links as attacker-reachable input requiring validation, prefers verified App Links/Universal Links, and checks least-privilege native permission sets. - Release-Build Verification: Mechanically greps for cleartext traffic settings, WebView debugging flags, and stray server.url configs, reporting findings as surface | risk | fix rows ordered by risk. - Use Case: Before shipping a Capacitor 6+ app, run a security sweep to confirm tokens live in the Keychain, deep links are validated, FLAG_SECURE protects sensitive screens, and release builds disable debugging and cleartext traffic. ## Quick Start Review this Ionic/Capacitor feature for mobile security issues and report findings as surface, risk, and fix.
