Comprehensive security guide for Capacitor apps using Capsec scanner. Covers 63+ security rules across secrets, storage, network, authentication, cryptography, and platform-specific vulnerabilities. Use this skill when users need to secure their mobile app or run security audits.

Capacitor Security with Capsec Zero config security scanning for Capacitor and Ionic apps. When to Use This Skill User wants to secure their app User asks about security vulnerabilities User needs to run security audit User has hardcoded secrets User needs CI/CD security scanning User asks about OWASP mobile security Quick Start with Capsec Run Security Scan Output Formats Filtering Security Rules Reference Secrets Detection (SEC) Rule Severity Description SEC001 Critical Hardcoded API Keys & Secrets SEC002 High Exposed .env File What Capsec Detects : AWS Access Keys Google API Keys Firebase Keys Stripe Keys GitHub Tokens JWT Secrets Database Credentials 30+ secret patterns Fix Example : Storage Security (STO) Rule Severity Description STO001 High Unencrypted Sensitive Data in Preferences STO002 High localStorage Usage for Sensitive Data STO003 Medium SQLite Database Without Encryption STO004 Medium Filesystem Storage of Sensitive Data STO005 Low Insecure Data Caching STO006 High Keychain/Keystore Not Used for Credentials Fix Example : Network Security (NET) Rule Severity Description NET001 Critical HTTP Cleartext Traffic NET002 High SSL/TLS Certificate Pinning Missing NET003 High Capacitor Server Cleartext Enabled NET004 Medium Insecure WebSocket Connection NET005 Medium CORS Wildcard Configuration NET006 Medium Insecure Deep Link Validation NET007 Low Capacitor HTTP Plugin Misuse NET008 High Sensitive Data in URL Parameters Fix Example : Capacitor Specific (CAP) Rule Severity Description CAP001 High WebView Debug Mode Enabled CAP002 Medium Insecure Plugin Configuration CAP003 Low Verbose Logging in Production CAP004 High Insecure allowNavigation CAP005 Critical Native Bridge Exposure CAP006 Critical Eval Usage with User Input CAP007 Medium Missing Root/Jailbreak Detection CAP008 Low Insecure Plugin Import CAP009 Medium Live Update Security CAP010 High Insecure postMessage Handler Fix Example : Android Security (AND) Rule Severity Description AND001 High Android Cleartext Traffic Allowed AND002 Medium Android Debug Mode Enabled AND003 Medium Insecure Android Permissions AND004 Low Android Backup Allowed AND005 High Exported Components Without Permission AND006 Medium WebView JavaScript Enabled Without Safeguards AND007 Critical Insecure WebView addJavascriptInterface AND008 Critical Hardcoded Signing Key Fix AndroidManifest.xml : network security config.xml : iOS Security (IOS) Rule Severity Description IOS001 High App Transport Security Disabled IOS002 Medium Insecure Keychain Access IOS003 Medium URL Scheme Without Validation IOS004 Low iOS Pasteboard Sensitive Data IOS005 Medium Insecure iOS Entitlements IOS006 Low Background App Refresh Data Exposure IOS007 Medium Missing iOS Jailbreak Detection IOS008 Low Screenshots Not Disabled for Sensitive Screens Fix Info.plist : Authentication (AUTH) Rule Severity Description AUTH001 Critical Weak JWT Validation AUTH002 High Insecure Biometric Implementation AUTH003 High Weak Random Number Generation AUTH004 Medium Missing Session Timeout AUTH005 High OAuth State Parameter Missing AUTH006 Critical Hardcoded Credentials in Auth Fix Example : WebView Security (WEB) Rule Severity Description WEB001 Critical WebView JavaScript Injection WEB002 Medium Unsafe iframe Configuration WEB003 Medium External Script Loading WEB004 Medium Content Security Policy Missing WEB005 Low Target blank Without noopener Fix Add CSP : Cryptography (CRY) Rule Severity Description CRY001 Critical Weak Cryptographic Algorithm CRY002 Critical Hardcoded Encryption Key CRY003 High Insecure Random IV Generation CRY004 High Weak Password Hashing Fix Example : Logging (LOG) Rule Severity Description LOG001 High Sensitive Data in Console Logs LOG002 Low Console Logs in Production Fix Example : CI/CD Integration GitHub Actions GitLab CI Configuration capsec.config.json Initialize Config Root/Jailbreak Detection Security Checklist Before Release [ ] Run npx capsec scan severity high [ ] Remove all console.log statements [ ] Disable WebView debugging [ ] Remove development URLs [ ] Verify no hardcoded secrets [ ] Enable certificate pinning [ ] Implement root/jailbreak detection [ ] Add Content Security Policy [ ] Use secure storage for credentials [ ] Enable ProGuard (Android) [ ] Verify ATS settings (iOS) Ongoing [ ] Run security scans in CI/CD [ ] Monitor for new vulnerabilities [ ] Update dependencies regularly [ ] Review third party plugins [ ] Audit authentication flows Resources Capsec Documentation: https://capacitor sec.dev OWASP Mobile Top 10: https://owasp.org/www project mobile top 10 OWASP MASTG: https://mas.owasp.org/MASTG Capgo Security Plugins: https://capgo.app

capacitor-security