Secure coding

Secure coding means thinking about security while writing code; not adding it later. Core principles: validate input, escape output, give least privilege, do not leak error messages.

In React Native user input comes from TextInput. Validate this input before using it: is the email format right, is the length over the limit? Escape it before sending to an API. Do not give internal server paths in error messages; show a general message. Do not log sensitive data to console.log; even with logs off in production it creates risk. These principles shrink the attack surface.

To validate an email input you check its format. A simple method: const emailOk = /[^@]+@[^@]+\.[^@]+/.test(email). This checks whether the email has an @ and a dot.

Stricter validation uses a library; but basic format checks stop most attacks. Length is also bounded: if (email.length > 200) return;. This makes buffer attacks with very long input harder. Validation is done both on the client and the server; the client can be skipped, the server cannot.