The leaks that matter usually aren't in production code — they're in the workflow around it. Five common ones: AsyncStorage for tokens , real user data in design mockups , multi-stage AI pipelines , logs and crash reports , and bundled permissions . Two greps that find real bugs today: AsyncStorage.setItem near token , and console.log(user / console.log(token / console.log(prompt . Model consent by purpose , not by OS permission. Camera consent is not AI-summarization consent...