Stack · Meta
Release testing for React Native apps
The JavaScript bundle ships to the device, so anything in it is readable, and purchases only behave in the store sandboxes. Release builds differ from debug builds; the checklist tests the former.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · store sandbox (Apple's and Google's test environments where purchases run without real money) · critical flow (a path a user takes that costs money or trust if it breaks: sign-up, checkout, invite, export) · verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
What React Native changes in a codebase
One JavaScript codebase compiled into iOS and Android apps. The bundle ships to the device, so anything in it is readable, and store sandboxes are the only place to see purchases behave.
A React Native release has more gates than a web release: two store sandboxes, permission prompts, an OS version matrix and, with Expo, an over-the-air channel. Growth covers one platform, Scale both.
Defaults, from the docs verified 2026-09-21
| Default, from the docs | Why it matters for release testing | Source |
|---|---|---|
| "Never store sensitive API keys in your app code. Anything included in your code could be accessed in plain text by anyone inspecting the app bundle." | SC-01 runs over the mobile bundle as well as the web bundle. | docs verified 2026-09-21 |
| Environment-variable tools "should not be confused with server-side environment variables, which can often contain secrets and API keys." | A .env file in a React Native project is part of the bundle; SC-03 treats every variable in it as public. | docs verified 2026-09-21 |
| Async Storage is an "unencrypted, key-value store"; tokens and secrets belong in Keychain (iOS) or Encrypted Shared Preferences (Android). | AU-06's session checks include where the token lives on the device. | docs verified 2026-09-21 |
| "Hermes is used by default by React Native and no additional configuration is required to enable it"; benefits show in a release build because JavaScript is compiled to bytecode at build time. | Performance and some crashes differ between debug and release builds; MB-03 runs the smoke suite on release builds only. | docs verified 2026-09-21 |
| For new apps the docs recommend a Framework: "Expo is a production-grade React Native Framework." | Most new AI-assisted mobile projects are Expo projects; the Expo hub's defaults apply on top of these. | docs verified 2026-09-21 |
Each row was read on the linked page on the date shown. Docs change; the date tells you how current the row is. React Native documentation.
Failure patterns most associated
- criticalIn-app purchase untested in the store sandbox
The purchase code was only run against a mock, so restore, failed payment and receipt validation break on real devices.
- highUser content rendered as markup
Text a user typed is inserted into the page as HTML, so a script in a name or comment runs in other users' browsers and can take their session.
- highModel output rendered or executed as trusted
Text from the model is inserted as HTML, used as a URL, or run as a command without validation.
- highPermission denial crashes or blanks the screen
The app assumes camera, location or notification permission was granted, and a denial leaves a blank screen or a crash.
- highOnly the latest OS version tested
The release runs on the developer's device and fails on the minimum supported OS version.
- highOver-the-air update skips the release gate
JavaScript changes go to every installed device through an OTA channel without the checks a store release gets.
- highSubscription renewal and lapse untested
Renewal, grace period, cancellation and refund leave the account in the wrong state because only the first purchase was ever exercised.
- mediumModel call with no timeout or fallback
A slow or failing provider leaves the user on a spinner and may retry without bound.
How the checklist adapts
- SC-01 scans the mobile bundle; SC-03 treats every .env variable as public.
- MB-01 and MB-05 run purchase and subscription flows in the Apple sandbox and with Play license testers, with accelerated renewals.
- MB-02 denies each permission at the prompt and permanently, then uses the feature.
- MB-03 runs the smoke suite on release builds on the minimum and latest supported OS versions.
Release checklist, five of the published items
v1.0 · verified on 2026-09-21No secret keys in client bundles
automated Scan the built client assets (JS, source maps, HTML) for known key prefixes and for every value present in the server environment file.
Zero matches for key prefixes (sk_, service_role, AKIA, whsec_, private keys) and zero server-only env values found in client assets.
Public environment prefix carries only public values
manual List every variable with a client-exposed prefix (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_, REACT_APP_) and confirm each one is meant to be public.
Every client-prefixed variable is documented as public; no variable holds a key that can write or read beyond the anonymous role.
Sessions end on logout and on password change
manual Keep a second browser signed in; log out and change the password in the first; retry a protected request in the second.
The second browser is signed out after both events.
Supported OS version matrix installed and smoke-tested
tool Install the release build on the minimum and latest supported versions of each platform and run the smoke suite (Appium or Detox).
Smoke suite passes on every cell of the written OS matrix.
Over-the-air updates pass the same release gate
manual Read the OTA update pipeline; confirm the verdict step precedes publish and that a previous update can be republished.
No OTA update can publish without a recorded verdict; rollback by republish was exercised this month.
Which plan fits
Growth $5,900/mo
Growth for one platform; Scale for iOS and Android together.
For 8-15 engineers, daily releases, web plus API or one mobile platform. Limits, cadence and what is not included.
Questions
React native release testing checklist
Mobile app release gate checklist
Get a risk list for your codebase
5 business days, $1,200, credited to the first month.