infinitered / infinitered/reactotron
Misconfiguration allow users to log all app requests and actions in a production App
- Dominant language
- TypeScript
- Stars
- 15.6k
- Forks
- 972
- PR merge metrics
- No merged PRs in 30d
Description
### Problem
According to the documentation to get started with Reactotron you need to import the config file just in `__DEV__` mode:
```js
if(__DEV__) {
import('./ReactotronConfig').then(() => console.log('Reactotron Configured'))
}
```
**Reference:** https://github.com/infinitered/reactotron/blob/master/docs/quick-start-react-native.md
But when you follow Reactotron config for redux integration documentation it says to import this file again, but this time without `__DEV__` verification. That initializes Reactotron in a production app, allowing any user to log all our requests and actions just by connecting his device to the PC and running `adb reverse tcp:9090 tcp:9090`
```diff
import { createStore } from 'redux'
+ import Reactotron from './ReactotronConfig'
- const store = createStore(rootReducer)
+ const store = createStore(rootReducer, Reactotron.createEnhancer())
+ // or const store = createStore(rootReducer, preloadedState, Reactotron.createEnhancer())
```
**Reference:** https://github.com/infinitered/reactotron/blob/master/docs/plugin-redux.md
### Solution
My proposal is to change the Docs to make sure that we are not logging any request or action in production applications. So other users will have this issue again.
**_OBS:_** Please let me know if I'm wrong with anything in this issue, or if there is somewhere in the docs explaining about it.
Contributor guide
Research direction
Compare docs/quick-start-react-native.md with docs/plugin-redux.md, focusing on how ReactotronConfig is imported in development and production. Update the Redux integration guidance so production apps do not initialize logging, then verify both examples consistently preserve the __DEV__ check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react-native
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100