Scan timing: clone 22.38s · analysis 33.63s · 54.1 MB · GitHub API rate-limit (preflight)
https://github.com/facebook/react-native
· scanned 2026-06-05 05:06 UTC (1 week, 1 day ago)
· 10 languages
1374 raw signals (170 security + 1204 graph) 11/13 scanners ran 50th percentile · Javascript · huge (>500K LoC) System graph score 56 (higher by 31)
Last scanned 1 week, 1 day ago · v2 · 552 actionable findings from 2 signal sources. 201 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.
| Component | Sub-score | Weight | Contribution |
|---|---|---|---|
structure_score |
60.0 | 0.15 | 9.00 |
security_score |
100.0 | 0.25 | 25.00 |
testing_score |
81.0 | 0.20 | 16.20 |
documentation_score |
100.0 | 0.15 | 15.00 |
practices_score |
100.0 | 0.15 | 15.00 |
code_quality |
66.0 | 0.10 | 6.60 |
| Overall | 1.00 | 86.8 |
Showing 330 of 552 actionable findings. 753 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.
packages/react-native/Libraries/Core/Devtools/loadBundleFromServer.js:190
packages/react-native-babel-preset/src/plugin-warn-on-deep-imports.js:60
scripts/cxx-api/parser/snapshot.py:47, 78, 108, 132, 181, 206, 212 (7 hits).github/workflows/test-all.yml:227, 272, 326, 349 (4 hits).github/workflows/nightly.yml:45, 76 (2 hits).github/workflows/fantom-tests.yml:23.github/workflows/publish-release.yml:55gradle/wrapper/gradle-wrapper.jar:1
packages/gradle-plugin/gradle/wrapper/gradle-wrapper.jar:1
private/helloworld/android/gradle/wrapper/gradle-wrapper.jar:1
packages/react-native/ReactAndroid/src/main/java/com/facebook/react/internal/featureflags/rewrite_feature_flag_defaults.py:69
packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/AgpConfiguratorUtils.kt:141
packages/eslint-config-react-native/shared.js:148
Eval used
packages/react-native/Libraries/Core/Devtools/loadBundleFromServer.js:190
Eval used
scripts/releases/ios-prebuild/folders.js:27
Exec used
scripts/releases/ios-prebuild/setupDependencies.js:70
Exec used
scripts/releases/utils/npm-utils.js:149
Exec used
scripts/releases/utils/release-utils.js:22
Exec used
scripts/releases/utils/scm-utils.js:32
Exec used
packages/react-native/React/CxxModule/RCTCxxUtils.mm:35
packages/react-native/React/Base/RCTAssert.m:149
scripts/cxx-api/parser/input_filters/main.py:41
Error handlingquality
scripts/cxx-api/parser/__main__.py:206
Error handlingquality
index.html
.well-known/security.txt
.github/actions/maestro-ios/action.yml:27
.github/actions/maestro-android/action.yml:35
.github/workflows/needs-attention.yml:21 (2 hits).github/workflows/autorebase.yml:25.github/workflows/e2e-ios-templateapp.yml:36.github/workflows/monitor-new-issues.yml:31.github/workflows/prebuild-ios-core.yml:167.github/workflows/prebuild-ios-dependencies.yml:151.github/workflows/on-issue-labeled.yml
CI/CD securitySupply chainGithub actions
.github/workflows/autorebase.yml
CI/CD securitySupply chainGithub actions
packages/react-native/scripts/cocoapods/utils.rb:757
Weak hash
packages/react-native/sdks/hermes-engine/hermes-utils.rb:229
Weak hash
packages/react-native-codegen/src/generators/components/GenerateStateH.js:30, 31, 32 (3 hits)packages/react-native-codegen/src/generators/components/GeneratePropsJavaInterface.js:123, 175 (2 hits)packages/react-native-codegen/src/generators/components/GenerateStateCpp.js:29, 30 (2 hits)packages/react-native-codegen/src/parsers/parserMock.js:1, 3 (2 hits)flow-typed/npm/listr_v14.x.x.js:2packages/eslint-plugin-specs/prepack.js:12packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/tasks/GeneratePackageListTask.kt:13packages/react-native-codegen/src/generators/components/GenerateComponentDescriptorH.js:36llms.txt
humans.txt
robots.txt
sitemap.xml
.github/workflows/test-all.yml:49, 115, 134, 155, 239, 284, 336, 366, +9 more (17 hits).github/workflows/prebuild-ios-dependencies.yml:13, 18, 35, 40, 65, 70, 82, 93, +8 more (16 hits).github/workflows/prebuild-ios-core.yml:31, 34, 67, 103, 109, 115, 135, 138, +5 more (13 hits).github/workflows/publish-release.yml:29, 74, 86, 96, 111, 120 (12 hits).github/workflows/on-issue-labeled.yml:19, 22, 42, 54, 55 (8 hits).github/workflows/create-draft-release.yml:16, 29, 39 (6 hits).github/workflows/e2e-android-templateapp.yml:28, 34, 39, 44 (4 hits).github/workflows/e2e-ios-templateapp.yml:28, 40, 47, 55 (4 hits)repo-level (6 hits)package.jsonpackages/react-native-codegen/package.jsonprivate/react-native-codegen-typescript-test/package.jsonscripts/cxx-api/parser/builders.py:960
scripts/cxx-api/parser/builders.py:753
scripts/cxx-api/parser/scope/base_scope_kind.py:49
scripts/cxx-api/parser/input_filters/strip_ns_unavailable.py:20
scripts/cxx-api/parser/input_filters/strip_block_comments.py:16
scripts/cxx-api/parser/scope/scope.py:236
Showing first 300 of 330. Refine filters or use the findings page for deep search.
This page is publicly accessible at:
https://repobility.com/scan/fd7f2e04-3ce2-42af-a904-2847dfc65c4d/
To check status programmatically (no auth required):
curl -s https://repobility.com/api/v1/public/scan/fd7f2e04-3ce2-42af-a904-2847dfc65c4d/
Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.