LaunchLint Academy
The short answer
A WebView is a trust boundary between web content and native capabilities. When third-party URLs, JavaScript bridges, file access, or sensitive sessions are involved, treat every navigation as untrusted input.
- Limit origins and paths, minimize bridge functions, separate external links, and test authentication, downloads, file selection, and failure states in the signed release.
Evidence required for release
Do not review webview security in hybrid apps as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Keep three evidence layers separate for WebView security in hybrid apps: statically visible project configuration, behavior on a clean device, and external settings in Apple Developer, App Store Connect, or Play Console. The review is reliable only when those layers describe the same release candidate. Give every mismatch an owner and a stop condition instead of assuming a default will be correct.
Evidence required for release
- Production value for map every webview identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
1. Map every WebView
Record start URL, allowed navigation, data, cookies, downloads, and native capabilities.
Do not review map every webview as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for map every webview identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
2. Define trusted origins
Validate scheme, host, and port completely. Substring or loose suffix checks can accept malicious domains.
Do not review define trusted origins as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for define trusted origins identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
3. Minimize JavaScript bridges
Expose only required methods, validate every message, and never load untrusted frames into a privileged bridge.
Do not review minimize javascript bridges as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for minimize javascript bridges identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
4. Restrict file and content access
Disable unnecessary file, content, and universal file URL access. Prefer a secure asset loader.
Do not review restrict file and content access as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for restrict file and content access identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
5. Control navigation and windows
Handle redirects, target=_blank, downloads, intent URLs, and handoff to an external browser deliberately.
Do not review control navigation and windows as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for control navigation and windows identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
6. Protect authentication and sessions
Review cookies, tokens, OAuth callbacks, logout, and screenshots so web and native sessions cannot drift.
Do not review protect authentication and sessions as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for protect authentication and sessions identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
7. Review Capacitor and plugins
Inventory navigation rules, server configuration, and plugins. A convenient bridge expands the attack surface.
Do not review review capacitor and plugins as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for review capacitor and plugins identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
8. Test realistic attack paths
Try manipulated URLs, hostile iframes, offline content, file selection, back navigation, and compromised content on real devices.
Do not review test realistic attack paths as an isolated switch. Connect it to WebView security in hybrid apps, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for test realistic attack paths identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
Frequently asked questions
Is Capacitor secure by default?
No. It provides an architecture; security depends on origins, plugins, navigation, web content, and native configuration.
Should JavaScript be disabled?
Yes when it is not needed. Hybrid apps often require it, which makes strict content and bridge controls essential.
Is a domain allowlist enough?
No. Path, scheme, redirects, messages, authorization, and the loaded resource also matter.
What can static analysis not prove?
It can find configuration and risky APIs but cannot observe every dynamic redirect, compromised server, or runtime document.