Capacitor Security

Audit and harden the app layer of a Capacitor app: secrets in the bundle, on-device storage, network transport, WebView and native bridge exposure, and platform manifests.

When to Use

TRIGGER when:

• The user asks for a security audit, OWASP Mobile Top 10 / MASVS review, or wants to fix pentest findings.
• The user wants to run or interpret @capgo/capgo-sec (capsec) results, rule IDs such as SEC001, STO002, NET003, CAP004, AND004, IOS001.
• API keys, service-role keys, or .env values appear in src/, dist/, www/, or capacitor.config.*.
• Auth tokens are stored with Preferences.set, localStorage, IndexedDB, or plain SQLite.
• capacitor.config.* contains server.cleartext: true, server.url, broad server.allowNavigation, android.allowMixedContent, or webContentsDebuggingEnabled: true.
• Native files contain NSAllowsArbitraryLoads, android:usesCleartextTraffic="true", android:allowBackup="true", android:debuggable, or exported components without permissions.
• The user needs certificate pinning, a Content Security Policy, screenshot protection, or root/jailbreak detection.