Security

An option no build will flag and only review can catch — how expo-secure-store's default keychain class syncs passwords to iCloud, and why "when you read it" is the decisive variable for choosing a class.

When wiring up an external identity provider, storing the id_token on the device tears open three channels at once: revocation, cold start, and audit. Starting from "single source of truth," a breakdown of the cookie-session contract and the JWT hardening checklist.

The answer to "where do you store the token" decides whether XSS risk is eliminated or merely relocated. Unpacking why the frontend holds no JWT, why CSRF becomes an unavoidable cost, how permission unions are computed, and why cache invalidation is harder than caching.