Push this scan report to remix-run/react-router

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Issue title

## Code-quality scan: `remix-run/react-router`

**Score: 63/100 (B-)**  ·  227 findings  ·  scanned 2026-06-05 10:04 UTC  ·  187,401 LOC

| Severity | Count |
|---|---|
| CRITICAL | 4 |
| HIGH | 77 |
| MEDIUM | 70 |
| LOW | 56 |

📊 [Full filterable report](https://repobility.com/scan/c1cae3d0-d9bd-47d8-9f47-019439663682/)  ·  ![scorecard](https://repobility.com/scan/c1cae3d0-d9bd-47d8-9f47-019439663682/report.png?v=1780653851-s2)

### Top findings

1. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `scripts/utils/process.ts:41`
2. **HIGH** `SEC083` — JS: new RegExp() with non-literal
   `packages/create-react-router/utils.ts:184`
3. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `packages/react-router-node/stream.ts:40`
4. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `packages/react-router-architect/server.ts:119`
5. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `integration/helpers/playwright-fixture.ts:324`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/c1cae3d0-d9bd-47d8-9f47-019439663682/_