facebook/react-native

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	100.0	0.25	25.00
`testing_score`	81.0	0.20	16.20
`documentation_score`	100.0	0.15	15.00
`practices_score`	100.0	0.15	15.00
`code_quality`	66.0	0.10	6.60
Overall		1.00	86.8

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED005] Lua Loadstring: loadstring/load executes Lua code. Code injection.

Review and fix per the pattern semantics. See CWE-95 / for context.

packages/react-native/React/DevSupport/RCTFrameTimingsObserver.mm:180 qualitylegacy

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED005] Lua Loadstring: loadstring/load executes Lua code. Code injection.

Review and fix per the pattern semantics. See CWE-95 / for context.

packages/react-native/Libraries/Image/RCTImageStoreManager.mm:159 qualitylegacy

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED019] Ssti Jinja From String: jinja2.Environment().from_string(user_input) — full RCE via templates.

Review and fix per the pattern semantics. See CWE-94 / A03:2021 for context.

packages/react-native-codegen/src/generators/modules/GenerateModuleObjCpp/header/serializeConstantsStruct.js:181 qualitylegacy

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.

Review and fix per the pattern semantics. See CWE-95 / for context.

packages/react-native/Libraries/Core/Devtools/loadBundleFromServer.js:190 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/scroll/generate-nested-scroll-view.js:44 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

packages/react-native-babel-transformer/src/index.js:235 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

packages/react-native-babel-preset/src/index.js:36 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED011] Scala Get On Option: Option.get throws NoSuchElementException on None. Use getOrElse / fold / match.

Review and fix per the pattern semantics. See CWE-476 / for context.

packages/react-native/React/Fabric/RCTScheduler.mm:203 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED011] Scala Get On Option: Option.get throws NoSuchElementException on None. Use getOrElse / fold / match.

Review and fix per the pattern semantics. See CWE-476 / for context.

packages/react-native/React/Base/RCTManagedPointer.mm:24 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — React skips re-render on mutated reference.

Review and fix per the pattern semantics. See CWE-682 / for context.

packages/react-native-babel-preset/src/plugin-warn-on-deep-imports.js:60 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self._ensure_scope_is_defined` used but never assigned in __init__: Method `_ensure_scope_is_defined` of class `Snapshot` reads `self._ensure_scope_is_defined`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self._ensure_scope_is_defined = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:206 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self._ensure_scope_is_defined` used but never assigned in __init__: Method `finish` of class `Snapshot` reads `self._ensure_scope_is_defined`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self._ensure_scope_is_defined = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:212 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.ensure_scope` used but never assigned in __init__: Method `create_enum` of class `Snapshot` reads `self.ensure_scope`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.ensure_scope = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:181 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.ensure_scope` used but never assigned in __init__: Method `create_interface` of class `Snapshot` reads `self.ensure_scope`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.ensure_scope = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:132 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.ensure_scope` used but never assigned in __init__: Method `create_or_get_namespace` of class `Snapshot` reads `self.ensure_scope`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.ensure_scope = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:78 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.ensure_scope` used but never assigned in __init__: Method `create_protocol` of class `Snapshot` reads `self.ensure_scope`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.ensure_scope = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:108 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.ensure_scope` used but never assigned in __init__: Method `create_struct_like` of class `Snapshot` reads `self.ensure_scope`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.ensure_scope = <default>` in __init__, or add a class-level default.

scripts/cxx-api/parser/snapshot.py:47 qualitylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-bumped-packages.yml:17 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/on-issue-labeled.yml:54 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/on-issue-labeled.yml:19 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/bump-podfile-lock.yml:11 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/needs-attention.yml:19 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/create-draft-release.yml:16 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-release.yml:74 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-release.yml:29 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/generate-changelog.yml:11 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/checkout@<40-char-sha> # v6` and let Dependabot bump it on a scheduled cadence.

.github/workflows/create-release.yml:26 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/on-issue-labeled.yml:55 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/on-issue-labeled.yml:42 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/on-issue-labeled.yml:22 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/create-draft-release.yml:39 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/create-draft-release.yml:29 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-release.yml:120 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-release.yml:111 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-release.yml:96 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/publish-release.yml:86 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/generate-changelog.yml:24 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/github-script@<40-char-sha> # v8` and let Dependabot bump it on a scheduled cadence.

.github/workflows/close-pr.yml:14 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/stale` pinned to mutable ref `@v10`: `uses: actions/stale@v10` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/stale@<40-char-sha> # v10` and let Dependabot bump it on a scheduled cadence.

.github/workflows/stale-bot.yml:30 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/stale` pinned to mutable ref `@v10`: `uses: actions/stale@v10` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: actions/stale@<40-char-sha> # v10` and let Dependabot bump it on a scheduled cadence.

.github/workflows/stale-bot.yml:13 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `react-native-community/needs-attention` pinned to mutable ref `@v2.0.0`: `uses: react-native-community/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: react-native-community/needs-attention@<40-char-sha> # v2.0.0` and let Dependabot bump it on a scheduled cadence.

.github/workflows/needs-attention.yml:21 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED126] Workflow container/services image `reactnativecommunity/react-native-android:latest` unpinned: `container/services image: reactnativecommunity/react-native-android:latest` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.

Replace with `reactnativecommunity/react-native-android:latest@sha256:<digest>`. Re-pin via Dependabot Docker scope.

.github/workflows/nightly.yml:76 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED126] Workflow container/services image `reactnativecommunity/react-native-android:latest` unpinned: `container/services image: reactnativecommunity/react-native-android:latest` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.

Replace with `reactnativecommunity/react-native-android:latest@sha256:<digest>`. Re-pin via Dependabot Docker scope.

.github/workflows/nightly.yml:45 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED126] Workflow container/services image `reactnativecommunity/react-native-android:latest` unpinned: `container/services image: reactnativecommunity/react-native-android:latest` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.

Replace with `reactnativecommunity/react-native-android:latest@sha256:<digest>`. Re-pin via Dependabot Docker scope.

.github/workflows/publish-release.yml:55 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `gradle/wrapper/gradle-wrapper.jar` committed in source repo: `gradle/wrapper/gradle-wrapper.jar` is a .jar binary (48,966 bytes) committed to a repo that otherwise has 5183 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

gradle/wrapper/gradle-wrapper.jar:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `packages/gradle-plugin/gradle/wrapper/gradle-wrapper.jar` committed in source repo: `packages/gradle-plugin/gradle/wrapper/gradle-wrapper.jar` is a .jar binary (48,966 bytes) committed to a repo that otherwise has 5183 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

packages/gradle-plugin/gradle/wrapper/gradle-wrapper.jar:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `private/helloworld/android/gradle/wrapper/gradle-wrapper.jar` committed in source repo: `private/helloworld/android/gradle/wrapper/gradle-wrapper.jar` is a .jar binary (46,175 bytes) committed to a repo that otherwise has 5183 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

private/helloworld/android/gradle/wrapper/gradle-wrapper.jar:1 dependencylegacy

high Legacy security path_traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

packages/react-native/ReactAndroid/src/main/java/com/facebook/react/internal/featureflags/rewrite_feature_flag_defaults.py:69

path_traversallegacy

high Legacy software xxe conf 1.00 [SEC024] XML External Entity (XXE) — Java parser default: Java XML parsers accept external entity references by default. An attacker can craft XML input that reads server files (file://), exfiltrates data via DNS, or causes denial of service via the 'billion laughs' attack.

Disable DTDs and external entities before parsing: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities"…

packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/AgpConfiguratorUtils.kt:141 xxelegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

packages/react-native-codegen/src/generators/components/GenerateEventEmitterH.js:164 xsslegacy

low Legacy quality quality conf 1.00 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).

Use a literal RegExp or whitelist-validate user input before constructing patterns.

packages/react-native-codegen/src/cli/combine/combine-js-to-schema-cli.js:42 qualitylegacy

low Legacy quality quality conf 1.00 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).

Use a literal RegExp or whitelist-validate user input before constructing patterns.

.github/workflow-scripts/checkForReproducer.js:81 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

.github/workflow-scripts/utils.js:25 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

.github/workflow-scripts/publishTemplate.js:33 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

.github/workflow-scripts/maestro-ios.js:62 qualitylegacy

high 9-layer api wiring conf 1.00 Dangling fetch: GET /api (packages/react-native-babel-preset/src/__tests__/transform-snapshot-test.js:443)

`packages/react-native-babel-preset/src/__tests__/transform-snapshot-test.js:443` calls `GET /api` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/` If this points at an external API, prefix it with `https://` so the…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: GET /api (packages/react-native-babel-preset/src/__tests__/transform-snapshot-test.js:468)

`packages/react-native-babel-preset/src/__tests__/transform-snapshot-test.js:468` calls `GET /api` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/` If this points at an external API, prefix it with `https://` so the…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: GET https://reactnative.dev/ (packages/rn-tester/js/examples/XHR/XHRExampleAbortController.js:22)

`packages/rn-tester/js/examples/XHR/XHRExampleAbortController.js:22` calls `GET https://reactnative.dev/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/reactnative.dev` If this points at an external API, pre…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: GET https://registry.npmjs.org/${pkg}/${versionOrTag} (.github/workflow-scripts/utils.js:15)

`.github/workflow-scripts/utils.js:15` calls `GET https://registry.npmjs.org/${pkg}/${versionOrTag}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/registry.npmjs.org/<p>/<p>` If this points at an external AP…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: POST https://example.org/post-image (packages/react-native/types/__typetests__/globals.tsx:196)

`packages/react-native/types/__typetests__/globals.tsx:196` calls `POST https://example.org/post-image` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/example.org/post-image` If this points at an external API…

wiringdangling-fetchfetch

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in packages/eslint-config-react-native/shared.js:148

Found a known-risky pattern (eval_used). Review and replace if possible.

packages/eslint-config-react-native/shared.js:148 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in packages/react-native/Libraries/Core/Devtools/loadBundleFromServer.js:190

Found a known-risky pattern (eval_used). Review and replace if possible.

packages/react-native/Libraries/Core/Devtools/loadBundleFromServer.js:190 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in scripts/releases/ios-prebuild/folders.js:27

Found a known-risky pattern (exec_used). Review and replace if possible.

scripts/releases/ios-prebuild/folders.js:27 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in scripts/releases/ios-prebuild/setupDependencies.js:70

Found a known-risky pattern (exec_used). Review and replace if possible.

scripts/releases/ios-prebuild/setupDependencies.js:70 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in scripts/releases/utils/npm-utils.js:149

Found a known-risky pattern (exec_used). Review and replace if possible.

scripts/releases/utils/npm-utils.js:149 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in scripts/releases/utils/release-utils.js:22

Found a known-risky pattern (exec_used). Review and replace if possible.

scripts/releases/utils/release-utils.js:22 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in scripts/releases/utils/scm-utils.js:32

Found a known-risky pattern (exec_used). Review and replace if possible.

scripts/releases/utils/scm-utils.js:32 owaspexec_used

medium Legacy quality error_handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

packages/react-native/React/CxxModule/RCTCxxUtils.mm:35 error_handlinglegacy

medium Legacy quality error_handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

packages/react-native/React/Base/RCTAssert.m:149 error_handlinglegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling.

scripts/cxx-api/parser/input_filters/main.py:41 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling.

scripts/cxx-api/parser/__main__.py:206 qualitylegacy

medium Legacy quality quality conf 0.70 Public web app has no Content Security Policy

Add a Content-Security-Policy header through the web framework or hosting config. For static apps, add a CSP meta tag that restricts default-src, script-src, connect-src, img-src, and frame-ancestors.

index.html qualitylegacy

medium Legacy quality quality conf 0.78 Public web service has no security.txt

Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.

.well-known/security.txt qualitylegacy

high Legacy software dependency conf 0.70 Remote install command pipes network code directly to a shell

Publish a package-manager install path or add checksum/signature verification before execution. For docs, show the inspect-then-run flow and pin the downloaded artifact version.

.github/actions/maestro-ios/action.yml:27 dependencylegacy

high Legacy software dependency conf 0.70 Remote install command pipes network code directly to a shell

Publish a package-manager install path or add checksum/signature verification before execution. For docs, show the inspect-then-run flow and pin the downloaded artifact version.

.github/actions/maestro-android/action.yml:35 dependencylegacy

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — .github/workflow-scripts/createDraftRelease.js:94

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — .github/workflow-scripts/generateChangelog.js:73

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — .github/workflow-scripts/utils.js:15

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — .github/workflow-scripts/verifyArtifactsAreOnMaven.js:25

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — flow-typed/npm/node-fetch_v2.x.x.js:182

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/community-cli-plugin/src/utils/version.js:160

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/dev-middleware/src/inspector-proxy/Device.js:1127

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/kitchen-sink-input.js:63

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/default-dev.js:119

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/default-prod.js:118

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-canary-dev.js:109

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-canary-prod.js:105

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-dev-preserve-async.js:96

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-dev-preserve-block-scoping.js:109

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-dev-preserve-class-private.js:95

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-dev-preserve-destructuring.js:108

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-dev.js:109

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-prod-no-import-export-transform.js:80

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/hermes-stable-prod.js:105

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/no-babel-runtime.js:131

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/no-import-export-transform.js:94

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/__fixtures__/output/with-babel-runtime-version.js:114

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-babel-preset/src/__tests__/transform-snapshot-test.js:443

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/Libraries/Core/Devtools/openFileInEditor.js:17

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/Libraries/Core/Devtools/openURLInBrowser.js:17

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/Libraries/Core/Devtools/symbolicateStackTrace.js:43

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/scripts/ios-prebuild/hermes.js:113

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/scripts/ios-prebuild/reactNativeDependencies.js:104

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/scripts/ios-prebuild/utils.js:71

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/src/types/globals.d.ts:137

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native/types/__typetests__/globals.tsx:196

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/rn-tester/js/examples/ContentURLAndroid/ContentURLAndroid.js:53

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/rn-tester/js/examples/Image/ImageExample.js:56

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/rn-tester/js/examples/WebSocket/WebSocketExample.js:208

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/rn-tester/js/examples/XHR/XHRExampleFetch.js:48

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — private/react-native-fantom/runner/bundling.js:141

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/release-testing/utils/github-actions-utils.js:85

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/releases-ci/publish-updated-packages.js:77

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/releases/upload-release-assets-for-dotslash.js:329

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

react-native-community/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/needs-attention.yml:21 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

apple-actions/import-codesign-certs@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/prebuild-ios-dependencies.yml:151 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

cirrus-actions/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/autorebase.yml:25 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

apple-actions/import-codesign-certs@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/prebuild-ios-core.yml:167 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

react-native-community/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/monitor-new-issues.yml:31 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

ruby/setup-ruby@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/e2e-ios-templateapp.yml:36 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/on-issue-labeled.yml supply-chaingithub-actionsleast-privilege

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/autorebase.yml supply-chaingithub-actionsleast-privilege

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in packages/react-native/scripts/cocoapods/utils.rb:757

Found a known-risky pattern (weak_hash). Review and replace if possible.

packages/react-native/scripts/cocoapods/utils.rb:757 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in packages/react-native/sdks/hermes-engine/hermes-utils.rb:229

Found a known-risky pattern (weak_hash). Review and replace if possible.

packages/react-native/sdks/hermes-engine/hermes-utils.rb:229 owaspweak_hash

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/cxx-api/parser/__main__.py:37

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/cxx-api/parser/doxygen.py:98

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer security coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

coverageauth

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

packages/react-native/Libraries/Animated/AnimatedEvent.js:101 qualitylegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

packages/debugger-frontend/index.js:24 qualitylegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

packages/assets-registry/path-support.js:66 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/parsers/typescript/components/componentsUtils.js:106 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/parsers/typescript/components/commands.js:76 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/parsers/parserMock.js:3 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/parsers/parserMock.js:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/parsers/parser.js:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/modules/GenerateModuleObjCpp/serializeEventEmitter.js:39 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/modules/GenerateModuleObjCpp/header/serializeRegularStruct.js:103 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/modules/GenerateModuleJniH.js:54 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/modules/GenerateModuleJniCpp.js:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GenerateThirdPartyFabricComponentsProviderObjCpp.js:35 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GenerateThirdPartyFabricComponentsProviderH.js:35 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GenerateShadowNodeH.js:44 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GenerateShadowNodeCpp.js:32 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GeneratePropsJavaPojo/PojoCollector.js:27 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GeneratePropsJavaInterface.js:175 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GeneratePropsJavaInterface.js:123 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GeneratePropsH.js:727 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GenerateEventEmitterH.js:282 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/react-native-codegen/src/generators/components/GenerateComponentDescriptorH.js:36 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/tasks/GeneratePackageListTask.kt:13 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

flow-typed/npm/listr_v14.x.x.js:2 qualitylegacy

low Legacy quality quality conf 0.64 Public docs site has no llms.txt

Add llms.txt with the product summary, canonical docs, API endpoints, security guidance, and preferred CLI workflow for AI agents.

llms.txt qualitylegacy

low Legacy quality quality conf 0.50 Public web app has no humans.txt

Add humans.txt with team ownership, contact URL, key documentation links, and the last-updated date.

humans.txt qualitylegacy

low Legacy quality quality conf 0.74 Public web app has no robots.txt

Add robots.txt at the web root or a framework-native robots route. Include an explicit Sitemap directive and disallow only private paths.

robots.txt qualitylegacy

low Legacy quality quality conf 0.72 Public web app has no sitemap

Add sitemap.xml, a sitemap index, or a framework-native sitemap route and reference it from robots.txt.

sitemap.xml qualitylegacy

low 9-layer quality maintenance conf 1.00 212 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

maintenance

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: .prettierrc.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: jest.config.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/core-cli-utils/src/private/types.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/core-cli-utils/src/public/version.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/__tests__/eslintrc-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/no-haste-imports-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/no-react-default-imports.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/no-react-named-type-imports.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/no-react-native-imports-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/no-react-node-imports-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/react-native-manifest-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/require-extends-error-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/__tests__/valid-flow-typed-signature-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/no-commonjs-exports.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/no-react-default-imports.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/no-react-named-type-imports.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/no-react-node-imports.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/eslint-plugin-monorepo/rules/react-native-manifest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/.prettierrc.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/__tests__/App.test.tsx

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/babel.config.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/cli.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/jest.config.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/lib/xcode.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/helloworld/scripts/metro.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/monorepo-tests/__tests__/no-dependencies-in-root-package-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/monorepo-tests/__tests__/no-dev-dependencies-in-react-native-package-test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/monorepo-tests/__tests__/no-dev-dependencies-in-tester-package.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-codegen-typescript-test/src/__tests__/simple-scenario-frontend-test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/config/babel-plugins/inject-debugger-statements-in-tests.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/config/hasteImpl.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/config/metro-babel-transformer.flow.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/config/metro-babel-transformer.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/config/metro.config.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/runner/coverage/types.flow.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/runner/global-setup/setup.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/runner/global-setup/teardown.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/runtime/mocks/ReactNativeInternalFeatureFlags.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/runtime/WarmUpEntryPoint.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomFeatureFlags-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomHermesVariantStaticHermes-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomHermesVariantStaticHermesExperimental-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomHighResTimeStampMockOpt-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomModeDefault-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomModeDev-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomModeDevBytecode-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomModeOpt-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomModuleInit-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/__tests__/FantomWeakRefs-itest.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: private/react-native-fantom/src/setUpDefaultReactNativeEnvironment.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate