Insecure Data Storage
Sensitive data like tokens, passwords, or personal information stored in plaintext on the device — in AsyncStorage, SharedPreferences, or local databases without encryption.
How It Works
Mobile devices can be lost, stolen, or accessed by malicious apps with root access. Storing sensitive data in plaintext in AsyncStorage (React Native), SharedPreferences (Android), UserDefaults (iOS), or SQLite without encryption means anyone with physical access or root can read it. This includes auth tokens, personal data, financial information, and cached API responses containing sensitive data.
// Storing sensitive data in plaintext
import AsyncStorage from '@react-native-async-storage';
await AsyncStorage.setItem('user_ssn', '123-45-6789');
await AsyncStorage.setItem('credit_card', '4111-1111-1111-1111');// Using encrypted storage
import EncryptedStorage from 'react-native-encrypted-storage';
await EncryptedStorage.setItem('user_token', token);
// For sensitive data: store on server, not on device
// SSN and credit cards should never be stored locallyReal-World Example
In 2018, researchers found that the Uber driver app stored session tokens in plaintext in SharedPreferences. A malicious app or rooted device could steal the token and access the driver's account, earnings, and personal information.
How to Prevent It
- Use encrypted storage (react-native-encrypted-storage, Keychain, EncryptedSharedPreferences)
- Never store highly sensitive data (SSN, credit cards) on the device
- Clear sensitive cached data when the user logs out
- Use the platform's secure enclave for cryptographic keys
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Improper Credential Usage
criticalHardcoded API keys, passwords, or tokens directly in mobile app source code — easily extracted by decompiling the app bundle.
Mobile Supply Chain Security
mediumVulnerable SDKs, outdated native libraries, or compromised third-party modules in your mobile app introduce security risks from your dependencies.
Insecure Authentication/Authorization
highMobile apps with weak authentication — storing sessions insecurely, missing token refresh, or authorization checks only on the client side.
Insufficient Input/Output Validation
mediumMobile apps that don't validate user input or sanitize output are vulnerable to injection attacks, data corruption, and unexpected behavior.