Skip to content

Facebook React development settings exposed

Description

The application exposes the com.facebook.react.devsupport.DevSettingsActivity activity. The DevSettingsActivity Activity exposes developer settings and should not be exposed in release versions of the application.

Recommendation

Disable com.facebook.react.devsupport.DevSettingsActivity in AndroidManifest.xml before deploying your app to the public.

<activity android:name="com.facebook.react.devsupport.DevSettingsActivity"
      android:exported="false"/>

Detect this with Ostorlab

Ostorlab checks Android and iOS apps for this issue.

Scan your app free

Standards

  • OWASP_MASVS_L1:
    • MSTG_ARCH_1
    • MSTG_CODE_4
  • OWASP_MASVS_L2:
    • MSTG_ARCH_1
    • MSTG_CODE_4
  • PCI_STANDARDS:
    • REQ_2_2
    • REQ_6_2
  • OWASP_MASVS_v2_1:
    • MASVS_RESILIENCE_3
  • OWASP_MOBILE_TOP_10:
    • M8_2024