This article highlights some security errors that are not really related to React Native:<p>1. Firebase permissions<p>That is a problem of a badly configured server, in firebase you need to write some rules that are less permissive as possible, making possible only to read what the user really needs (for example it's own data and the data that is truly public), same for writing.<p>2. Debug files in the APK<p>The map file should not be in the APK (unless it's an internal-only debuggable APK), webpack/gulp can be configured to not produce that file when the target is production.<p>If you use tools that collect errors like Sentry, you can upload the map file to their servers and avoid releasing it.<p>It will not stop the attacker from obtaining your API_KEY but it will make it harder (security through obscurity).<p>Both problems are not exclusive to React Native but are shared to any app/web-app that uses firebase.