infinitered / infinitered/reactotron

Misconfiguration allow users to log all app requests and actions in a production App

Open
#1,192 2 comments 2 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
15.6k
Forks
972
PR merge metrics
No merged PRs in 30d

Description

### Problem

According to the documentation to get started with Reactotron you need to import the config file just in `__DEV__` mode:

```js
if(__DEV__) {
import('./ReactotronConfig').then(() => console.log('Reactotron Configured'))
}
```
**Reference:** https://github.com/infinitered/reactotron/blob/master/docs/quick-start-react-native.md

But when you follow Reactotron config for redux integration documentation it says to import this file again, but this time without `__DEV__` verification. That initializes Reactotron in a production app, allowing any user to log all our requests and actions just by connecting his device to the PC and running `adb reverse tcp:9090 tcp:9090`

```diff
import { createStore } from 'redux'
+ import Reactotron from './ReactotronConfig'

- const store = createStore(rootReducer)
+ const store = createStore(rootReducer, Reactotron.createEnhancer())
+ // or const store = createStore(rootReducer, preloadedState, Reactotron.createEnhancer())
```
**Reference:** https://github.com/infinitered/reactotron/blob/master/docs/plugin-redux.md

### Solution

My proposal is to change the Docs to make sure that we are not logging any request or action in production applications. So other users will have this issue again.

**_OBS:_** Please let me know if I'm wrong with anything in this issue, or if there is somewhere in the docs explaining about it.

Contributor guide

Open the contributing guide

Research direction

Compare docs/quick-start-react-native.md with docs/plugin-redux.md, focusing on how ReactotronConfig is imported in development and production. Update the Redux integration guidance so production apps do not initialize logging, then verify both examples consistently preserve the __DEV__ check.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, react-native
Domain
documentation, security
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.