Bug Description
A lot of the "vulnerabilities" turned out to be mismatching on like substrings in react components name e.g., "HashtagIcon" triggers hashing function rule, even though absolutely no crypto was involved in that code path.
In the end after capturing the json report and passing it to claude for analysis, the results were essentially: "~86 findings, 0 confirmed vulnerabilities, 2 worth a human glance"
To Reproduce
Steps to reproduce the behavior:
- Clone a popular open-source react-native project
- Run
rnsec scan
- Review the report and perform some assessment of whether the issue detected actually existed or not.
Expected Behavior
Reports should be high signal, low noise, especially for security scanning. Too much noise here makes the tool not worth using, even though it did catch two things that may actually be worth a look. An end user, unless pairing this with an AI agent to assess the output, would likely either freak out or ignore as "too many issues"
For instance, the scanner flagged a bunch of IMPROPER_BIOMETRIC_FALLBACK all in files like locale/locales/*/messages.ts, which is clearly not helpful at all. Or MISSING_SESSION_TIMEOUT triggering on file names and contents that simply mentioned authentication, not even containing any potentially problematic code, e.g., triggers on even types.ts, SplashScreen, logged-out thread views).
THIRD_PARTY_SDK_RISK triggered for "third-party SDKs" that didn't actually even exist in the project, e.g., the segment SDK wasn't used, but we used a unicode segmenter package for working with UTF8 byte ranges.
Actual Behavior
Mostly captured above: tool produced 86 findings, but only 2 were mildly actionable, the rest either simply did not exist (false-positives) or were invalid (e.g., JSON.parse and then passing output to like zod or some other validation logic).
Environment
- rnsec version: 1.3.0
- Node version: 24 or 26
- OS: macOS
- React Native/Expo version:
- React Native: 0.81.5
- Expo: 54.0.34
- React / React DOM: 19.1.0
Command Output
not really applicable, as I can't say which project I ran this on, but I can say it's a well known open source react native app with some pretty complex features and code.
Bug Description
A lot of the "vulnerabilities" turned out to be mismatching on like substrings in react components name e.g., "HashtagIcon" triggers hashing function rule, even though absolutely no crypto was involved in that code path.
In the end after capturing the json report and passing it to claude for analysis, the results were essentially: "~86 findings, 0 confirmed vulnerabilities, 2 worth a human glance"
To Reproduce
Steps to reproduce the behavior:
rnsec scanExpected Behavior
Reports should be high signal, low noise, especially for security scanning. Too much noise here makes the tool not worth using, even though it did catch two things that may actually be worth a look. An end user, unless pairing this with an AI agent to assess the output, would likely either freak out or ignore as "too many issues"
For instance, the scanner flagged a bunch of
IMPROPER_BIOMETRIC_FALLBACKall in files likelocale/locales/*/messages.ts, which is clearly not helpful at all. OrMISSING_SESSION_TIMEOUTtriggering on file names and contents that simply mentioned authentication, not even containing any potentially problematic code, e.g., triggers on even types.ts, SplashScreen, logged-out thread views).THIRD_PARTY_SDK_RISKtriggered for "third-party SDKs" that didn't actually even exist in the project, e.g., the segment SDK wasn't used, but we used a unicode segmenter package for working with UTF8 byte ranges.Actual Behavior
Mostly captured above: tool produced 86 findings, but only 2 were mildly actionable, the rest either simply did not exist (false-positives) or were invalid (e.g.,
JSON.parseand then passing output to like zod or some other validation logic).Environment
Command Output
not really applicable, as I can't say which project I ran this on, but I can say it's a well known open source react native app with some pretty complex features and code.