Found while reviewing #33.
packages/react-native/src/Cordierite.types.ts:57-63 documents linkPin as trusted only "when built in debug mode with no build-time cliPins configured" and says "release builds without pins keep the existing hard error". That predates the explicit trust mode: resolveTrustedPins on both platforms consults no build-type signal, and docs/SECURITY.md "Trust modes" describes link trust as available in any build type when no cliPins are configured.
Fix: reword the comment to match docs/SECURITY.md (trust mode "link" is the default whenever cliPins is empty, in every build type; embedded pins always win). No behaviour change.
Found while reviewing #33.
packages/react-native/src/Cordierite.types.ts:57-63documentslinkPinas trusted only "when built in debug mode with no build-timecliPinsconfigured" and says "release builds without pins keep the existing hard error". That predates the explicittrustmode:resolveTrustedPinson both platforms consults no build-type signal, anddocs/SECURITY.md"Trust modes" describes link trust as available in any build type when nocliPinsare configured.Fix: reword the comment to match
docs/SECURITY.md(trust mode"link"is the default whenevercliPinsis empty, in every build type; embedded pins always win). No behaviour change.