Is there a recommended way to remove access to unneeded PhoneGap APIs?
For example our app does not need to access the contact database.
With normal web pages, a
In your app, under PhoneGap.plist/Plugins, remove any rows for plugins that are not needed - this will remove access from JavaScript.
PhoneGap is Open Source. You could make your own copies of the PhoneGap.js files with those functions disabled (put return false; as the first line of the function or something).
On Android you can do it with the permissions in the AndroidManifest.xml file, but as far as I know, there is not such feature for iOS.