[Security] AsyncStorage used as fallback for sensitive data when MMKV fails — plaintext storage of tokens

[RUKAYAT-CODER]

Overview

If MMKV storage initialization fails, some code paths fall back to AsyncStorage for persisting auth-adjacent data. AsyncStorage is unencrypted plaintext storage — using it for session-related data exposes tokens on rooted/jailbroken devices.

Specifications

Features:

• Remove AsyncStorage as a fallback for any auth or session-related data
• If MMKV fails, show a storage error screen rather than downgrading to plaintext storage

Tasks:

• Audit all AsyncStorage usages and categorize them (sensitive vs non-sensitive)
• Replace sensitive AsyncStorage usages with secureStorage or remove the fallback
• Add a lint rule to warn on AsyncStorage usage in auth-related files

Impacted Files:

• src/store/createStore.ts
• src/services/secureStorage.ts
• All files importing AsyncStorage for auth-related data

Acceptance Criteria

• No AsyncStorage used for tokens or session data
• MMKV failure shows a recovery screen, not a plaintext fallback
• Lint rule prevents future AsyncStorage use in auth modules

[Chinonso-Peter]

@Chinonso-Peter has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Can i work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chinonso-Peter to this issue.

[toniasteve15-ui]

@toniasteve15-ui has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hey Maintainer, I have gone through the details of the issue and i am capable of resolving it, I would love to be assigned to work on it ASAP.please assign me!!
ETA: 4 hours

ℹ️ Repo Maintainers: To accept this application, review their application or assign @toniasteve15-ui to this issue.

[fathiaoyinloye]

@fathiaoyinloye has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I'd like to work on this issue. I have relevant experience with the technologies and concepts involved, and I'm confident I can make the necessary implementation to ensure the it meets the acceptance criteria. I'd be happy to contribute to this task.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @fathiaoyinloye to this issue.

[felixakintoyese]

@felixakintoyese has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainer, i would love to work one this issue, i already reviewed the description and will submit a clean PR, please kindly assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @felixakintoyese to this issue.

[ezehalexa]

@ezehalexa has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I'd like to work on this issue! because I am very conversant with solving problems like this!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ezehalexa to this issue.

[daveedAJ]

@daveedAJ has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi Team,

I'd like to work on this issue. I'll remove plaintext storage fallbacks for sensitive data, ensure MMKV failures display a recovery screen, audit AsyncStorage usage, and add safeguards to prevent future insecure usage.

Thanks for considering me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @daveedAJ to this issue.

[abdulrcrtw]

@abdulrcrtw has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would like to take on this issue. I will carefully implement the required changes with attention to code quality, testing, and integration with the existing codebase.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @abdulrcrtw to this issue.

[DTriple-p]

@DTriple-p has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi there, I'd like to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @DTriple-p to this issue.