nativekeel 0.1.11 → 0.1.12

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.11:** the GitHub Action is fixed and tested on every change. **0.1.10:** every report opens with *Start here*, the three most urgent first steps; missing iOS permission texts (a crash and an App Review rejection) are caught. Recent releases added known vulnerabilities in the exact versions you ship, password leaks into logs and databases, unsafe WebViews, open Android components, plain-HTTP API calls and runtime crash risks. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.12:** hacking risks mapped to OWASP MASVS: open Firebase rules, TLS certificate checks turned off, hardcoded keys and weak crypto, tokens in plain storage, with a security overview in every report. **0.1.10:** every report opens with *Start here*, the three most urgent first steps; missing iOS permission texts (a crash and an App Review rejection) are caught. Recent releases added known vulnerabilities in the exact versions you ship, password leaks into logs and databases, unsafe WebViews, open Android components, plain-HTTP API calls and runtime crash risks. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 It answers the questions that decide whether your app can still ship:
 
@@ -18,7 +18,8 @@ It answers the questions that decide whether your app can still ship:
 - **Are secrets shipped inside your app?** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth keys, private keys and Supabase `service_role` keys (anon keys are fine), plus `.env` values that `react-native-config` or `EXPO_PUBLIC_` compile into the bundle. Server-side folders are reported separately.
 - **Is transport security off?** Cleartext HTTP or `debuggable` in the release Android manifest, `NSAllowsArbitraryLoads` on iOS.
 - **Do you ship known vulnerabilities?** Advisories from the GitHub Advisory Database for the exact versions in your lockfile or `node_modules`. Advisories that only affect Node.js servers are kept, at low severity.
-- **Can someone read your users' data?** Passwords that flow into crash reports, analytics, remote databases or plain AsyncStorage (followed through intermediate variables), WebViews that let page scripts read local files or load HTTP into HTTPS, Android backups that copy tokens, Android components any app can start, API calls over plain HTTP.
+- **Can someone break in?** Grouped by OWASP MASVS: Firebase Realtime Database/Firestore/Storage rules open to anyone (or in test mode), TLS certificate checks turned off in native code, hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode, `Math.random` for nonces and salts. These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app would.
+- **Can someone read your users' data?** Passwords that flow into crash reports, analytics, remote databases or plain AsyncStorage (followed through intermediate variables), WebViews that let page scripts read local files or load HTTP into HTTPS, Android backups that copy tokens, Android components any app can start, API calls over plain HTTP, auth tokens in unencrypted storage.
 - **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist description iOS requires.
 - **Leftovers from old templates?** Flipper, JavaScriptCore instead of Hermes.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -5,7 +5,7 @@ import { createRegistry, fetchJson } from './registry.js';
 import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
 import { stabilityChecks } from './stability.js';
-import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls } from './security.js';
+import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
@@ -405,12 +405,16 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   for (const f of stabilityChecks(project)) add(f);
 
   // Security beyond leaked keys.
-  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root)]) add(f);
+  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root)]) add(f);
   if (!forcedOffline) {
     // Exact versions only (installed, else the lockfile): a range would be a guess.
     const locked = lockedVersions(project.root, project.deps);
     const exact = {};
     for (const name of Object.keys(project.deps)) {
+      // Advisories describe npm registry packages. A dependency from git, a URL or a local
+      // path is a different package that only shares the name (e.g. a squatted name with a
+      // malware advisory), so it is not matched.
+      if (/:\/\/|^(github|gitlab|bitbucket|git|file|link|workspace|portal|patch):|^[\w.-]+\/[\w.-]+(#|$)/.test(String(project.deps[name]))) continue;
       const v = installedVersion(project.root, name) || locked[name];
       if (v && /^\d+\.\d+\.\d+/.test(v)) exact[name] = v;
     }
@@ -453,6 +457,14 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   }
 
   reportIncomplete();
+  // OWASP MASVS group for every security finding, and a per-group count (zero means checked, clean).
+  const security = Object.fromEntries(Object.keys(MASVS_GROUPS).map((g) => [g, 0]));
+  for (const f of findings) {
+    const g = masvsOf(f.id);
+    if (!g) continue;
+    f.masvs = g;
+    if (f.severity !== 'info') security[g]++;
+  }
   findings.sort((a, b) => SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf(b.severity));
   return {
     tool: 'nativekeel',
@@ -467,6 +479,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       android: project.android,
     },
     latest: { reactNative: rn && rn.latest, expo: expo && expo.latest },
+    security,
     offline,
     offlineRequested: forcedOffline,
     warnings,

package/src/plan.js

@@ -274,21 +274,25 @@ export function buildPlan(result) {
     });
   }
 
-  const securitySteps = [];
-  for (const m of byKind('manifest')) {
-    securitySteps.push(m.attr === 'android:debuggable'
-      ? 'Remove `android:debuggable="true"` from `android/app/src/main/AndroidManifest.xml`.'
-      : 'Move `android:usesCleartextTraffic="true"` to `android/app/src/debug/AndroidManifest.xml`, or allow only specific hosts with a network security config.');
-  }
-  for (const a of byKind('ats')) {
-    securitySteps.push(`In \`${a.file}\`, set \`NSAllowsArbitraryLoads\` to false and list only the hosts that need HTTP under \`NSExceptionDomains\`.`);
-  }
-  for (const f of byKind('security')) securitySteps.push(f.step);
-  const vulns = byKind('vuln-dep').filter((v) => v.severity === 'critical' || v.severity === 'high');
-  for (const v of vulns) {
-    securitySteps.push(`Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to} or later` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}`);
+  // Security steps, most severe first (they feed "Start here").
+  const sevRank = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+  const sec = [];
+  for (const f of result.findings) {
+    if (!f.fix) continue;
+    const sev = sevRank[f.severity] ?? 4;
+    if (f.fix.kind === 'manifest') {
+      sec.push({ sev, step: f.fix.attr === 'android:debuggable' ? 'Remove `android:debuggable="true"` from `android/app/src/main/AndroidManifest.xml`.' : 'Move `android:usesCleartextTraffic="true"` to `android/app/src/debug/AndroidManifest.xml`, or allow only specific hosts with a network security config.' });
+    } else if (f.fix.kind === 'ats') {
+      sec.push({ sev, step: `In \`${f.fix.file}\`, set \`NSAllowsArbitraryLoads\` to false and list only the hosts that need HTTP under \`NSExceptionDomains\`.` });
+    } else if (f.fix.kind === 'security') {
+      sec.push({ sev, step: f.fix.step });
+    } else if (f.fix.kind === 'vuln-dep' && (f.fix.severity === 'critical' || f.fix.severity === 'high')) {
+      const v = f.fix;
+      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to} or later` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
+    }
   }
-  const minorVulns = byKind('vuln-dep').length - vulns.length;
+  const securitySteps = sec.sort((a, b) => a.sev - b.sev).map((x) => x.step);
+  const minorVulns = byKind('vuln-dep').filter((v) => v.severity !== 'critical' && v.severity !== 'high').length;
   if (minorVulns) securitySteps.push(`${minorVulns} more package${minorVulns === 1 ? ' has' : 's have'} moderate or low advisories: update them with the routine package updates below.`);
   if (securitySteps.length) {
     phases.push({ title: 'Close security gaps', why: 'Attackers read app bundles, network traffic and logs. These are the ways in this app hands them something.', steps: securitySteps });

package/src/report-html.js

@@ -1,6 +1,7 @@
 import { SEVERITIES, countBySeverity } from './analyze.js';
 import { SITE_URL } from './config.js';
 import { startHere } from './plan.js';
+import { MASVS_GROUPS } from './security.js';
 
 const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
 // Turns `code` spans from finding text into <code>.
@@ -60,6 +61,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
 .start{background:var(--card);border:1px solid var(--line);border-left:4px solid var(--accent);border-radius:8px;padding:6px 18px 10px;margin-top:20px}.start h2{margin:10px 0 6px}.start li{margin:6px 0}
+.secgrid{display:grid;grid-template-columns:repeat(3,1fr);gap:8px}.sg{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:10px 12px;display:flex;flex-direction:column}.sg b{font-size:20px}.sg.ok b{color:var(--accent)}.sg.bad b{color:var(--critical)}.sg small{color:var(--muted)}@media (max-width:560px){.secgrid{grid-template-columns:1fr 1fr}}
 details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}
 .f{display:flex;gap:12px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}
 .f p{margin:2px 0 0;color:var(--muted);font-size:14px}.f strong{overflow-wrap:anywhere}
@@ -91,6 +93,9 @@ ${p.android && p.android.targetSdk ? `<span>targetSdk <b>${p.android.targetSdk}<
 <span>${result.deps.length} dependencies (${result.deps.filter((d) => d.native).length} native)</span>
 </div>
 ${n.critical + n.high > 0 ? `<section class="start"><h2>Start here</h2><ol>${startHere(result).map((x) => `<li>${rich(x.step)} <span class="muted">(${esc(x.phase)})</span></li>`).join('')}</ol><p class="muted">The full, ordered plan: <code>npx nativekeel plan</code>.</p></section>` : ''}
+${result.security ? `<section class="sec"><h2>Security <small>OWASP MASVS</small></h2><div class="secgrid">${Object.entries(MASVS_GROUPS)
+  .map(([g, label]) => `<div class="sg ${result.security[g] ? 'bad' : 'ok'}"><b>${result.security[g] ? result.security[g] : '✓'}</b><span>${esc(label)}</span><small>MASVS-${g}</small></div>`)
+  .join('')}</div><p class="muted">Static checks of code, config and dependencies. They find the common, detectable mistakes; they do not replace a penetration test of the running app and its backend.</p></section>` : ''}
 <h2>Findings</h2>
 ${result.findings.length ? `${rows ? `<ul class="list">${rows}</ul>` : ''}${bumpTable}` : '<p>No issues found.</p>'}
 ${planHtml}

package/src/report-text.js

@@ -62,6 +62,11 @@ export function textReport(result, { color = true, verbose = false } = {}) {
   }
   const n = countBySeverity(result.findings);
   out.push(`${c.bold('Summary')}  ${c.red(`${n.critical} critical`)} · ${c.yellow(`${n.high} high`)} · ${n.medium} medium · ${n.low} low`);
+  if (result.security) {
+    const groups = Object.entries(result.security);
+    const withIssues = groups.filter(([, k]) => k > 0).map(([g, k]) => `${g.toLowerCase()} ${k}`);
+    out.push(`${c.bold('Security')} (OWASP MASVS)  ${withIssues.length ? withIssues.join(' · ') : c.green('no issues')}${c.gray(`  ·  ${groups.length} groups checked`)}`);
+  }
 
   if (n.critical + n.high > 0) {
     out.push('');

package/src/security.js

@@ -46,6 +46,7 @@ export async function vulnerableDependencies(registry, versions) {
   const findings = [];
   for (const [name, list] of Object.entries(advisories)) {
     const version = versions[name];
+    if (!version || !Array.isArray(list)) continue; // only what we asked about
     // The endpoint answers for the versions we sent; double-check the range where it is simple.
     const relevant = list.filter((a) => applies(version, a.vulnerable_versions));
     if (!relevant.length) continue;
@@ -333,3 +334,264 @@ export function plainHttpCalls(root) {
     },
   ];
 }
+
+// Firebase security rules kept in the repo. An open database or bucket is the most common way
+// mobile app data leaks: anyone with the project id (it ships in the app) can read or wipe it.
+export function cloudRules(root, deps, now = new Date()) {
+  const findings = [];
+  const dirs = [root, path.dirname(root), path.dirname(path.dirname(root))];
+  const findFile = (names) => {
+    for (const d of dirs) for (const n of names) if (fs.existsSync(path.join(d, n))) return path.join(d, n);
+    return null;
+  };
+  const rel = (f) => path.relative(root, f) || path.basename(f);
+  const usesFirebaseData = Object.keys(deps).some((n) => /^@react-native-firebase\/(database|firestore|storage)$|^firebase$/.test(n));
+
+  // Realtime Database (JSON). `.read`/`.write` set to true, or "auth != null" at the root.
+  const rtdb = findFile(['database.rules.json']);
+  if (rtdb) {
+    const text = read(rtdb);
+    const openWrite = /"\.write"\s*:\s*(?:true|"true")/.test(text);
+    const openRead = /"\.read"\s*:\s*(?:true|"true")/.test(text);
+    const rootAuthOnly = /"rules"\s*:\s*\{\s*"\.(?:read|write)"\s*:\s*"auth\s*!==?\s*null"/.test(text);
+    if (openWrite || openRead) {
+      findings.push(rulesFinding('firebase-rtdb-open', openWrite ? 'critical' : 'high', `Realtime Database rules let anyone ${openWrite ? 'write' : 'read'} (${rel(rtdb)})`, `A rule sets ${openWrite ? '".write"' : '".read"'} to true. The database URL ships inside the app, so anyone can ${openWrite ? 'change or delete your data' : 'download it'} without signing in.`, `In \`${rel(rtdb)}\`, replace the true rules with auth and owner checks (e.g. "auth.uid === $uid").`));
+    } else if (rootAuthOnly) {
+      findings.push(rulesFinding('firebase-rtdb-any-user', 'medium', `Realtime Database rules give every signed-in user the whole database (${rel(rtdb)})`, 'The root rule only checks "auth != null". Anyone who can create an account (or sign in anonymously) can read or write every user\'s data.', `In \`${rel(rtdb)}\`, scope the rules per path, e.g. "auth.uid === $uid".`));
+    }
+  }
+
+  // Firestore and Storage rules: `allow ...: if true`, a bare `allow read, write;`, or
+  // test-mode rules (`request.time < timestamp.date(...)`).
+  for (const [names, label, id] of [[['firestore.rules'], 'Firestore', 'firebase-firestore'], [['storage.rules'], 'Cloud Storage', 'firebase-storage']]) {
+    const file = findFile(names);
+    if (!file) continue;
+    const text = read(file).replace(/\/\/.*$/gm, '');
+    const testMode = text.match(/request\.time\s*<\s*timestamp\.date\(\s*(\d{4})\s*,\s*(\d{1,2})\s*,\s*(\d{1,2})\s*\)/);
+    const { openWrite, openReadAll } = scanAllowRules(text);
+    if (testMode) {
+      const until = new Date(Date.UTC(Number(testMode[1]), Number(testMode[2]) - 1, Number(testMode[3])));
+      if (until > now) {
+        findings.push(rulesFinding(`${id}-test-mode`, 'critical', `${label} is in test mode until ${until.toISOString().slice(0, 10)} (${rel(file)})`, 'Test-mode rules allow every read and write from anyone until that date.', `Replace the test-mode rules in \`${rel(file)}\` with rules that check request.auth and the document owner.`));
+      } else {
+        findings.push(rulesFinding(`${id}-test-mode-expired`, 'high', `${label} test-mode rules expired on ${until.toISOString().slice(0, 10)} (${rel(file)})`, 'Past that date every request is denied, so the app cannot read or write its data, and the rules in the repo do not describe real access control.', `Write real rules in \`${rel(file)}\` (request.auth and owner checks).`));
+      }
+    } else if (openWrite) {
+      findings.push(rulesFinding(`${id}-open-write`, 'critical', `${label} rules let anyone write (${rel(file)}:${openWrite})`, 'A write rule has no condition (or "if true"). Your Firebase project id ships inside the app, so anyone can change or delete this data without signing in.', `In \`${rel(file)}\`, require request.auth (and the owner's uid) for every write.`));
+    } else if (openReadAll) {
+      findings.push(rulesFinding(`${id}-open-read`, 'high', `${label} rules let anyone read everything (${rel(file)}:${openReadAll})`, 'A recursive wildcard match ({path=**}) allows reads with no condition, so all data is public to anyone who has the project id (it ships inside the app).', `In \`${rel(file)}\`, limit public reads to the paths that are meant to be public.`));
+    }
+  }
+
+  if (!findings.length && usesFirebaseData && !rtdb && !findFile(['firestore.rules', 'storage.rules'])) {
+    findings.push({
+      id: 'firebase-rules-not-in-repo',
+      severity: 'info',
+      area: 'security',
+      title: 'Firebase data is used, but its security rules are not in the repository',
+      detail: 'Open database or storage rules are the most common way mobile app data leaks, and NativeKeel cannot see rules that live only in the Firebase console. Review them there (no "if true", no root-level "auth != null"), or keep them in the repo (firebase init) so they are reviewed and checked.',
+    });
+  }
+  return findings;
+}
+
+function rulesFinding(id, severity, title, detail, step) {
+  return { id, severity, area: 'security', title, detail, fix: { kind: 'security', step } };
+}
+
+// Line numbers of an unconditional write anywhere, and of an unconditional read in a match that
+// is only a recursive wildcard (/{document=**}). Public reads of specific paths can be intentional.
+function scanAllowRules(text) {
+  const lines = text.split('\n');
+  const stack = []; // match paths of the open blocks
+  let openWrite = 0;
+  let openReadAll = 0;
+  lines.forEach((line, i) => {
+    const code = line.replace(/\/\/.*$/, '');
+    const m = code.match(/match\s+(\S+)\s*\{/);
+    if (m) stack.push(m[1]);
+    const allow = code.match(/allow\s+([\w,\s]+?)\s*(?::\s*if\s+(.+?))?\s*;/);
+    if (allow) {
+      const unconditional = !allow[2] || /^true$/.test(allow[2].trim());
+      const ops = allow[1];
+      if (unconditional && /\b(write|create|update|delete)\b/.test(ops)) openWrite = openWrite || i + 1;
+      if (unconditional && /\b(read|get|list)\b/.test(ops) && /^\/\{[^}]*=\*\*\}$/.test(stack.at(-1) || '')) openReadAll = openReadAll || i + 1;
+    }
+    const closes = (code.match(/\}/g) || []).length - (code.match(/\{/g) || []).length;
+    for (let k = 0; k < closes && stack.length; k++) stack.pop();
+  });
+  return { openWrite, openReadAll };
+}
+
+// Native code that turns off TLS certificate checks: anyone on the same Wi-Fi can read and
+// change the app's HTTPS traffic (MASVS-NETWORK-1).
+export function insecureTls(root) {
+  const files = [];
+  const collect = (dir, exts) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        if (!['Pods', 'build', 'node_modules', '.gradle', 'DerivedData', 'test', 'androidTest'].includes(e.name) && !/Tests?$/.test(e.name)) collect(full, exts);
+      } else if (exts.test(e.name)) {
+        files.push(full);
+      }
+    }
+  };
+  collect(path.join(root, 'android'), /\.(java|kt)$/);
+  collect(path.join(root, 'ios'), /\.(m|mm|swift)$/);
+  const PATTERNS = [
+    { re: /checkServerTrusted\s*\([^)]*\)\s*(?:throws[^{]*)?(?::\s*Unit\s*)?\{\s*\}/, what: 'a TrustManager whose checkServerTrusted accepts every certificate' },
+    { re: /(?:ALLOW_ALL_HOSTNAME_VERIFIER|NoopHostnameVerifier|AllowAllHostnameVerifier)|verify\s*\(\s*\w+\s*:?\s*String\??[^)]*\)\s*(?::\s*Boolean\s*)?(?:\{\s*return\s+true\s*;?\s*\}|=\s*true)|hostnameVerifier\s*\{\s*_\s*,\s*_\s*->\s*true\s*\}/, what: 'a hostname verifier that accepts every host' },
+    { re: /onReceivedSslError[\s\S]{0,300}?\.proceed\s*\(\s*\)/, what: 'a WebView that proceeds on SSL errors' },
+    { re: /allowsAnyHTTPSCertificateForHost|setAllowsAnyHTTPSCertificate/, what: 'an iOS API that accepts any HTTPS certificate' },
+  ];
+  const hits = [];
+  // A setting like "ignore TLS errors" or "trust self-signed" anywhere in the native code: the
+  // bypass is often defined in one file and switched on from another.
+  const optInSetting = /(?:ignore\w*(?:ssl|tls|cert)\w*|trustSelfSigned|allowSelfSigned|selfSignedCert)/i;
+  const projectOptIn = files.some((f) => optInSetting.test(read(f)));
+  for (const f of files) {
+    const text = read(f);
+    if (!text) continue;
+    // A bypass behind a setting (trust a self-signed home server, an "ignore TLS errors" switch)
+    // is an opt-in feature: still worth reviewing, but not the same as trusting everything.
+    const OPT_IN = /\bif\s*\(?[^\n]*(?:validate|verif|trust|self.?signed|ignore\w*(?:ssl|tls|cert)|insecure|allowInvalid|acceptInvalid|unsafe)/i;
+    const optIn = (index) => {
+      const before = text.slice(Math.max(0, index - 1200), index).split('\n').slice(-25).join('\n');
+      return OPT_IN.test(before) || projectOptIn;
+    };
+    for (const p of PATTERNS) {
+      const m = text.match(p.re);
+      if (m) hits.push({ file: path.relative(root, f), line: text.slice(0, m.index).split('\n').length, what: p.what, optIn: optIn(m.index) });
+    }
+    // iOS: answering a server-trust challenge with the server's own trust, without evaluating it.
+    if (/\.(m|mm|swift)$/.test(f) && /(?:URLCredential\(\s*trust:|credentialForTrust:)/.test(text) && !/SecTrustEvaluate|SecTrustEvaluateWithError|evaluate\(/.test(text)) {
+      const idx = text.search(/URLCredential\(\s*trust:|credentialForTrust:/);
+      hits.push({ file: path.relative(root, f), line: text.slice(0, idx).split('\n').length, what: 'a URL session that trusts the server certificate without evaluating it', optIn: optIn(idx) });
+    }
+  }
+  const findings = hits.map((h) =>
+    h.optIn
+      ? {
+          id: `insecure-tls:${h.file}`,
+          severity: 'high',
+          area: 'security',
+          title: `TLS certificate checks can be switched off (${h.file}:${h.line})`,
+          detail: `This file has ${h.what}, behind a setting (it looks like an opt-in for self-signed or self-hosted servers). While it is on, anyone on the same network can read and change that traffic. Keep it off by default, limit it to the one server the user chose (or pin that server's certificate), and say so clearly in the UI. (OWASP MASVS-NETWORK-1)`,
+          fix: { kind: 'security', step: `Review the certificate bypass in \`${h.file}:${h.line}\`: off by default, limited to the user's own server, ideally certificate pinning instead.` },
+        }
+      : {
+          id: `insecure-tls:${h.file}`,
+          severity: 'critical',
+          area: 'security',
+          title: `TLS certificate checks are turned off (${h.file}:${h.line})`,
+          detail: `This file has ${h.what}, with no setting around it. Anyone on the same network (public Wi-Fi, a compromised router) can read and change the app's HTTPS traffic, including logins and tokens. Remove it; for a self-signed development server, use a debug-only network security config instead. (OWASP MASVS-NETWORK-1)`,
+          fix: { kind: 'security', step: `Remove the certificate bypass in \`${h.file}:${h.line}\` (${h.what}).` },
+        },
+  );
+
+  // Release builds that trust user-installed certificates: a classic interception setup.
+  const xmlDir = path.join(root, 'android', 'app', 'src', 'main', 'res', 'xml');
+  let xmls = [];
+  try {
+    xmls = fs.readdirSync(xmlDir).filter((f) => f.endsWith('.xml'));
+  } catch {
+    // no res/xml
+  }
+  for (const x of xmls) {
+    const text = read(path.join(xmlDir, x)).replace(/<debug-overrides>[\s\S]*?<\/debug-overrides>/g, '');
+    if (/<network-security-config/.test(text) && /<certificates\s+src\s*=\s*"user"/.test(text)) {
+      findings.push({
+        id: `user-certificates:${x}`,
+        severity: 'low',
+        area: 'security',
+        title: `Release builds trust user-installed certificates (res/xml/${x})`,
+        detail: 'A certificate the user (or malware, or a device profile) installs can intercept the app\'s HTTPS traffic. Apps for company servers with a private CA sometimes need this; otherwise keep <certificates src="user"/> inside <debug-overrides> only. (OWASP MASVS-NETWORK-1)',
+        fix: { kind: 'security', step: `In \`android/app/src/main/res/xml/${x}\`, move \`<certificates src="user"/>\` into \`<debug-overrides>\`.` },
+      });
+    }
+  }
+  return findings;
+}
+
+// Cryptography that looks like protection but is not (MASVS-CRYPTO-1/2), and session tokens in
+// unencrypted storage (MASVS-STORAGE-1).
+const CRYPTO_RULES = [
+  { id: 'hardcoded-key', re: /\b(?:CryptoJS\.(?:AES|DES|TripleDES|Rabbit|RC4)\.(?:encrypt|decrypt)\s*\([^,()]+,\s*['"`][^'"`]{4,}['"`]|createCipheriv\s*\(\s*['"][^'"]+['"]\s*,\s*['"`][^'"`]{4,}['"`])/, severity: 'high', title: 'Encryption key hardcoded in the app', detail: 'The key is a string in the JavaScript bundle, so anyone can extract it and decrypt the data. Derive keys per user (e.g. from the Keychain/Keystore) or keep encryption on the server.' },
+  { id: 'weak-password-hash', re: /\b(?:md5|sha1|MD5|SHA1)\s*\(\s*[^)]*\bpass(?:word|wd)?\b/i, severity: 'high', title: 'Password hashed with MD5 or SHA-1', detail: 'MD5 and SHA-1 are fast and broken for passwords: anyone who captures the hash cracks it in minutes. To store or verify passwords, let the server use bcrypt, scrypt or Argon2; to derive an encryption key from a password, use PBKDF2, scrypt or Argon2; if a server protocol forces it, prefer that server\'s token or API-key login.' },
+  { id: 'ecb-mode', re: /CryptoJS\.mode\.ECB|['"]aes-\d+-ecb['"]/i, severity: 'medium', title: 'Encryption in ECB mode', detail: 'ECB encrypts equal blocks to equal output, so patterns in the data stay visible. Use an authenticated mode such as AES-GCM.' },
+  { id: 'insecure-random', re: /\b(?:nonce|secret|otp|salt|password|passcode|apikey|api_key|csrf|verifier|pkce)\w*\s*[=:]\s*[^;\n]*Math\.random\s*\(/i, severity: 'medium', title: 'Math.random used for a security value', detail: 'Math.random is predictable. Use crypto.getRandomValues (react-native-get-random-values or expo-crypto) for tokens, nonces, salts and codes.' },
+];
+
+export function weakCrypto(root) {
+  const byRule = new Map();
+  for (const file of jsFiles(root)) {
+    const text = read(file);
+    if (!text || !/CryptoJS|createCipheriv|md5|sha1|MD5|SHA1|Math\.random/.test(text)) continue;
+    // Comments describing an algorithm are not code.
+    const code = text.replace(/\/\*[\s\S]*?\*\//g, (c) => c.replace(/[^\n]/g, ' ')).replace(/\/\/[^\n]*/g, '');
+    for (const rule of CRYPTO_RULES) {
+      const m = code.match(rule.re);
+      if (m && !byRule.has(rule.id)) byRule.set(rule.id, { rule, where: `${path.relative(root, file)}:${code.slice(0, m.index).split('\n').length}` });
+    }
+  }
+  return [...byRule.values()].map(({ rule, where }) => ({
+    id: `crypto-${rule.id}`,
+    severity: rule.severity,
+    area: 'security',
+    title: `${rule.title} (${where})`,
+    detail: `${rule.detail} (OWASP MASVS-CRYPTO)`,
+    fix: { kind: 'security', step: `${rule.title} at \`${where}\`: ${rule.detail.split('. ').slice(-1)[0]}` },
+  }));
+}
+
+// Auth tokens written to AsyncStorage: on a rooted/jailbroken device, or from a backup, they
+// can be read and reused to act as the user.
+export function tokenStorage(root) {
+  const hits = [];
+  for (const file of jsFiles(root)) {
+    const text = read(file);
+    if (!text || !/AsyncStorage|MMKV/.test(text)) continue;
+    for (const m of text.matchAll(/\b(?:AsyncStorage\.setItem|storage\.set|mmkv\.set)\s*\(\s*['"`@]?([\w@.\-:]*?(?:access_?token|refresh_?token|auth_?token|id_?token|jwt|session_?token|bearer)[\w.\-:]*)['"`]?\s*,/gi)) {
+      hits.push(`${m[1]} (${path.relative(root, file)}:${text.slice(0, m.index).split('\n').length})`);
+    }
+  }
+  if (!hits.length) return [];
+  return [
+    {
+      id: 'token-unencrypted-storage',
+      severity: 'low',
+      area: 'security',
+      title: `Auth token${hits.length === 1 ? '' : 's'} stored without encryption`,
+      detail: `${hits.slice(0, 3).join(', ')}${hits.length > 3 ? ', …' : ''}. AsyncStorage (and unencrypted MMKV) is plain files: backups and rooted devices expose them, and a copied token signs in as the user. Keep tokens in the Keychain/Keystore (react-native-keychain, expo-secure-store). (OWASP MASVS-STORAGE-1)`,
+      fix: { kind: 'security', step: 'Move auth tokens from AsyncStorage to the Keychain/Keystore (`react-native-keychain` or `expo-secure-store`).' },
+    },
+  ];
+}
+
+// OWASP MASVS control group of a security finding, by id. Shown in reports so a security
+// reviewer can map findings to the standard they audit against.
+export const MASVS_GROUPS = {
+  STORAGE: 'Data on the device',
+  CRYPTO: 'Keys and cryptography',
+  AUTH: 'Access control (backend rules)',
+  NETWORK: 'Network traffic',
+  PLATFORM: 'WebViews and platform interaction',
+  CODE: 'Dependencies and build',
+};
+
+export function masvsOf(id) {
+  if (/^(secret:|env-bundled|crypto-)/.test(id)) return 'CRYPTO';
+  if (/^(password-leak|token-unencrypted|android-allow-backup)/.test(id)) return 'STORAGE';
+  if (/^(insecure-tls|user-certificates|plain-http|ios-ats|android-cleartext)/.test(id)) return 'NETWORK';
+  if (/^(webview-|android-exported)/.test(id)) return 'PLATFORM';
+  if (/^firebase-/.test(id)) return 'AUTH';
+  if (/^(vuln:|signing-|android-debuggable)/.test(id)) return 'CODE';
+  return null;
+}