25-Finding Pentest Report Reveals Critical Security Flaws in React Native Tenant App

A developer recently reviewed a full penetration test report on a React Native tenant app they had built, uncovering 25 security findings ranging from critical to informational. Among the most serious issues was a chain vulnerability where a forgot-password endpoint leaked internal user IDs, which could be combined with a change-password flow that never verified the current password, allowing account takeover without credentials. Other significant findings included an IDOR flaw in password generation, absent server-side file content validation that allowed malicious uploads to pass through, and a complete lack of rate limiting on sensitive actions. Additional problems included plaintext exposure of sensitive personal data in API responses, session tokens remaining valid after logout, and a debug panel left active in production that exposed full request logs and tokens. The developer noted that many of these issues appeared low-risk in isolation but combined to create serious vulnerabilities, highlighting the importance of server-side validation and cross-endpoint security thinking.