nativekeel 0.1.12 → 0.1.14

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.12:** hacking risks mapped to OWASP MASVS: open Firebase rules, TLS certificate checks turned off, hardcoded keys and weak crypto, tokens in plain storage, with a security overview in every report. **0.1.10:** every report opens with *Start here*, the three most urgent first steps; missing iOS permission texts (a crash and an App Review rejection) are caught. Recent releases added known vulnerabilities in the exact versions you ship, password leaks into logs and databases, unsafe WebViews, open Android components, plain-HTTP API calls and runtime crash risks. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. **0.1.13:** performance traps (nested lists, JS-thread animations, release console logs, heavy imports, oversized images) and reverse-engineering exposure (source maps in the app, Hermes/R8 off). **0.1.12:** hacking risks mapped to OWASP MASVS: open Firebase rules, TLS certificate checks turned off, hardcoded keys and weak crypto, tokens in plain storage, with a security overview in every report. **0.1.10:** every report opens with *Start here*, the three most urgent first steps; missing iOS permission texts (a crash and an App Review rejection) are caught. Recent releases added known vulnerabilities in the exact versions you ship, password leaks into logs and databases, unsafe WebViews, open Android components, plain-HTTP API calls and runtime crash risks. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 It answers the questions that decide whether your app can still ship:
 
@@ -15,12 +15,14 @@ It answers the questions that decide whether your app can still ship:
 - **Which packages block the upgrade?** Native modules without New Architecture support, unmaintained or with no release in years, with known alternatives. Outdated "unmaintained" flags are cross-checked against the latest npm release.
 - **What can you simply delete?** Packages that are installed but never imported, referenced natively or required by another package. Every one you remove is one you never upgrade.
 - **Will the stores accept your next build?** Google Play `targetSdk` and 16 KB page size (it opens your built APK/AAB and checks the alignment of every native library), and the iOS privacy manifest.
-- **Are secrets shipped inside your app?** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth keys, private keys and Supabase `service_role` keys (anon keys are fine), plus `.env` values that `react-native-config` or `EXPO_PUBLIC_` compile into the bundle. Server-side folders are reported separately.
+- **Are secrets shipped inside your app?** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth keys, private keys and Supabase `service_role` keys (anon keys are fine), plus `.env` values that `react-native-config` or `EXPO_PUBLIC_` compile into the bundle, and secrets in Expo `extra` or `eas.json`. Server-side folders are reported separately.
 - **Is transport security off?** Cleartext HTTP or `debuggable` in the release Android manifest, `NSAllowsArbitraryLoads` on iOS.
 - **Do you ship known vulnerabilities?** Advisories from the GitHub Advisory Database for the exact versions in your lockfile or `node_modules`. Advisories that only affect Node.js servers are kept, at low severity.
 - **Can someone break in?** Grouped by OWASP MASVS: Firebase Realtime Database/Firestore/Storage rules open to anyone (or in test mode), TLS certificate checks turned off in native code, hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode, `Math.random` for nonces and salts. These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app would.
 - **Can someone read your users' data?** Passwords that flow into crash reports, analytics, remote databases or plain AsyncStorage (followed through intermediate variables), WebViews that let page scripts read local files or load HTTP into HTTPS, Android backups that copy tokens, Android components any app can start, API calls over plain HTTP, auth tokens in unencrypted storage.
-- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist description iOS requires.
+- **Is it slow or heavy?** A FlatList inside a ScrollView (no virtualization), animations with `useNativeDriver: false`, `console.log` left in release builds, whole-library `lodash`/`moment` imports, images over 500 KB that the app requires. Static signs to measure on a device, not a profiler.
+- **Can it be taken apart?** Source maps packaged into the app, Hermes or R8 off in release (OWASP MASVS-RESILIENCE). Obfuscation only slows an attacker down; keep secrets and checks on the server.
+- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist description iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …).
 - **Leftovers from old templates?** Flipper, JavaScriptCore instead of Hermes.
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -5,7 +5,8 @@ import { createRegistry, fetchJson } from './registry.js';
 import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
 import { stabilityChecks } from './stability.js';
-import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, masvsOf, MASVS_GROUPS } from './security.js';
+import { performanceChecks } from './performance.js';
+import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
@@ -403,9 +404,11 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   // 7. Secrets
   // Setups that build and then crash at runtime.
   for (const f of stabilityChecks(project)) add(f);
+  // Static signs of performance problems.
+  for (const f of performanceChecks(project)) add(f);
 
   // Security beyond leaked keys.
-  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root)]) add(f);
+  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root)]) add(f);
   if (!forcedOffline) {
     // Exact versions only (installed, else the lockfile): a range would be a guess.
     const locked = lockedVersions(project.root, project.deps);

package/src/performance.js

@@ -0,0 +1,163 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Performance problems you can see in the code: things that make lists stutter, animations run
+// on the JavaScript thread, or the app download heavier than it needs to be. Runtime profiling
+// (frame drops, start-up time) needs a device; these are the static signs.
+
+const SKIP_DIRS = new Set(['node_modules', '.git', 'Pods', 'build', '.gradle', 'DerivedData', '.expo', 'dist', 'coverage', 'vendor', '__tests__', '__mocks__', 'e2e', 'android', 'ios']);
+const JS_EXT = /\.(?:[cm]?[jt]sx?)$/;
+
+function* walk(dir, test) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      if (!SKIP_DIRS.has(e.name) && !e.name.startsWith('.')) yield* walk(path.join(dir, e.name), test);
+    } else if (test.test(e.name) && !/\.(test|spec)[._]/.test(e.name)) {
+      yield path.join(dir, e.name);
+    }
+  }
+}
+
+const read = (file) => {
+  try {
+    return fs.statSync(file).size > 512 * 1024 ? '' : fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+};
+
+// The props text of the JSX tag starting at `start` (up to its closing `>` or `/>`, skipping
+// `>` inside {...} expressions such as arrow functions).
+function tagProps(text, start) {
+  let depth = 0;
+  for (let i = start + 1; i < text.length && i < start + 4000; i++) {
+    const c = text[i];
+    if (c === '{') depth++;
+    else if (c === '}') depth--;
+    else if (c === '>' && depth === 0) return { props: text.slice(start, i), end: i + 1 };
+  }
+  return { props: text.slice(start, start + 4000), end: start + 4000 };
+}
+
+export function performanceChecks(project) {
+  const root = project.root;
+  const findings = [];
+  const nested = [];
+  let jsDriver = 0;
+  let jsDriverAt = null;
+  let logs = 0;
+  const heavyImports = new Map();
+  for (const file of walk(root, JS_EXT)) {
+    const text = read(file);
+    if (!text) continue;
+    const rel = path.relative(root, file);
+    const code = text.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+
+    // A vertical FlatList/SectionList inside a vertical ScrollView renders every item at once
+    // (React Native warns "VirtualizedLists should never be nested").
+    // JSX tags only: not TypeScript generics like useRef<ScrollView>(null).
+    for (const m of code.matchAll(/(?<![\w.$])<ScrollView\b/g)) {
+      const open = tagProps(code, m.index);
+      if (/\bhorizontal\b/.test(open.props)) continue;
+      const close = code.indexOf('</ScrollView>', open.end);
+      if (close < 0) continue;
+      const body = code.slice(open.end, close);
+      const im = body.match(/(?<![\w.$])<(FlatList|SectionList|FlashList)\b/);
+      if (!im) continue;
+      const inner = tagProps(body, im.index);
+      if (!/\bhorizontal\b/.test(inner.props) && !/scrollEnabled\s*=\s*\{\s*false\s*\}/.test(inner.props)) {
+        nested.push(`${rel}:${code.slice(0, m.index).split('\n').length}`);
+      }
+    }
+    // Animations driven from JavaScript: every frame crosses to the JS thread.
+    for (const m of code.matchAll(/useNativeDriver\s*:\s*false/g)) {
+      jsDriver++;
+      jsDriverAt = jsDriverAt || `${rel}:${code.slice(0, m.index).split('\n').length}`;
+    }
+    logs += (code.match(/\bconsole\.(?:log|debug|info)\s*\(/g) || []).length;
+    // Whole-library imports of packages with per-function or lighter alternatives.
+    if (/from\s+['"]lodash['"]|require\(\s*['"]lodash['"]\s*\)/.test(code)) heavyImports.set('lodash', heavyImports.get('lodash') || rel);
+    if (/from\s+['"]moment['"]|require\(\s*['"]moment['"]\s*\)/.test(code)) heavyImports.set('moment', heavyImports.get('moment') || rel);
+  }
+
+  if (nested.length) {
+    findings.push({
+      id: 'perf-nested-lists',
+      severity: 'medium',
+      area: 'performance',
+      title: `A list inside a ScrollView renders every item at once (${nested[0]}${nested.length > 1 ? ` and ${nested.length - 1} more` : ''})`,
+      detail: 'A vertical FlatList/SectionList inside a vertical ScrollView loses virtualization: all rows mount up front, which costs memory and makes long lists stutter or crash on low-end Android. Use the list as the scroll container and move the other content into ListHeaderComponent/ListFooterComponent.',
+      fix: { kind: 'performance', step: `In \`${nested[0]}\`, make the FlatList the scroll container (ListHeaderComponent/ListFooterComponent) instead of nesting it in a ScrollView.` },
+    });
+  }
+  if (jsDriver >= 3) {
+    findings.push({
+      id: 'perf-js-driven-animations',
+      severity: 'low',
+      area: 'performance',
+      title: `${jsDriver} animations run on the JavaScript thread (useNativeDriver: false, e.g. ${jsDriverAt})`,
+      detail: 'Each frame of these animations waits for JavaScript, so they drop frames whenever the app is busy. Transform and opacity animations can use useNativeDriver: true; layout animations can move to Reanimated.',
+      fix: { kind: 'performance', step: 'Switch transform/opacity animations to `useNativeDriver: true` (or Reanimated for layout properties).' },
+    });
+  }
+  const babel = ['babel.config.js', '.babelrc', 'babel.config.json'].map((f) => read(path.join(root, f))).join('\n');
+  if (logs >= 30 && !/transform-remove-console|remove-console/.test(babel)) {
+    findings.push({
+      id: 'perf-console-in-release',
+      severity: 'low',
+      area: 'performance',
+      title: `${logs} console.log calls ship in the release build`,
+      detail: 'They run in production, slow the JavaScript thread in hot paths, and can write user data to the device log. Strip them from release builds with babel-plugin-transform-remove-console (keep console.error/warn).',
+      fix: { kind: 'performance', step: "Add `['transform-remove-console', { exclude: ['error', 'warn'] }]` to the production `env` of your Babel config." },
+    });
+  }
+  if (heavyImports.size) {
+    const advice = { lodash: 'import single functions (lodash/debounce) or use lodash-es with tree shaking', moment: 'use dayjs or date-fns (moment is in maintenance mode and pulls in all locales)' };
+    findings.push({
+      id: 'perf-heavy-imports',
+      severity: 'low',
+      area: 'performance',
+      title: `Whole-library imports of ${[...heavyImports.keys()].join(' and ')}`,
+      detail: `${[...heavyImports].map(([k, at]) => `${k} (${at}): ${advice[k]}`).join('; ')}. They add hundreds of KB to the bundle the app parses at start-up.`,
+      fix: { kind: 'performance', step: `Replace whole-library imports: ${[...heavyImports.keys()].map((k) => advice[k]).join('; ')}.` },
+    });
+  }
+
+  // Oversized images bundled with the app (require()d from code): download size and decode
+  // memory. Screenshots and docs in the repo are not part of the app, so only required files count.
+  const big = [];
+  const seen = new Set();
+  for (const file of walk(root, JS_EXT)) {
+    const text = read(file);
+    for (const m of text.matchAll(/require\(\s*['"](\.{1,2}\/[^'"]+\.(?:png|jpe?g|gif|webp))['"]\s*\)|import\s+\w+\s+from\s+['"](\.{1,2}\/[^'"]+\.(?:png|jpe?g|gif|webp))['"]/gi)) {
+      const img = path.resolve(path.dirname(file), m[1] || m[2]);
+      if (seen.has(img)) continue;
+      seen.add(img);
+      try {
+        const size = fs.statSync(img).size;
+        if (size > 500 * 1024) big.push({ rel: path.relative(root, img), size });
+      } catch {
+        // missing or @2x variant only
+      }
+    }
+  }
+  if (big.length) {
+    big.sort((a, b) => b.size - a.size);
+    const total = big.reduce((s, b) => s + b.size, 0);
+    findings.push({
+      id: 'perf-large-images',
+      severity: big.length >= 5 || total > 10 * 1024 * 1024 ? 'medium' : 'low',
+      area: 'performance',
+      title: `${big.length} image${big.length === 1 ? '' : 's'} over 500 KB in the app (${(total / 1024 / 1024).toFixed(1)} MB)`,
+      detail: `${big.slice(0, 3).map((b) => `${b.rel} (${Math.round(b.size / 1024)} KB)`).join(', ')}${big.length > 3 ? ', …' : ''}. They grow the download and take memory when decoded. Resize to the size shown on screen (2x/3x) and use WebP.`,
+      fix: { kind: 'performance', step: `Resize and convert the largest bundled images (${big.slice(0, 2).map((b) => `\`${b.rel}\``).join(', ')}) to WebP at the size shown on screen.` },
+    });
+  }
+  return findings;
+}

package/src/plan.js

@@ -66,6 +66,7 @@ const WEIGHTS = {
   'folly-flags': () => 0.25,
   'default-react-host': () => 0.25,
   crash: () => 1,
+  performance: () => 0.5,
   security: () => 1,
   'vuln-dep': (f) => (f.severity === 'critical' || f.severity === 'high' ? 1 : 0.25),
 };
@@ -526,6 +527,15 @@ export function buildPlan(result) {
     });
   }
 
+  const perf = byKind('performance');
+  if (perf.length) {
+    phases.push({
+      title: 'Speed up the app',
+      why: 'Static signs of jank and weight. Measure on a low-end Android device before and after: these are the usual suspects, not proof.',
+      steps: perf.map((p) => p.step),
+    });
+  }
+
   const jsBumps = byKind('bump-dep').filter((d) => !d.native && !movesWithExpo(d.name));
   if (jsBumps.length) {
     phases.push({

package/src/security.js

@@ -584,14 +584,130 @@ export const MASVS_GROUPS = {
   NETWORK: 'Network traffic',
   PLATFORM: 'WebViews and platform interaction',
   CODE: 'Dependencies and build',
+  RESILIENCE: 'Reverse engineering',
 };
 
 export function masvsOf(id) {
-  if (/^(secret:|env-bundled|crypto-)/.test(id)) return 'CRYPTO';
+  if (/^(secret:|env-bundled|crypto-|expo-secret)/.test(id)) return 'CRYPTO';
   if (/^(password-leak|token-unencrypted|android-allow-backup)/.test(id)) return 'STORAGE';
   if (/^(insecure-tls|user-certificates|plain-http|ios-ats|android-cleartext)/.test(id)) return 'NETWORK';
   if (/^(webview-|android-exported)/.test(id)) return 'PLATFORM';
   if (/^firebase-/.test(id)) return 'AUTH';
   if (/^(vuln:|signing-|android-debuggable)/.test(id)) return 'CODE';
+  if (/^(sourcemap-in-app|easy-reverse-engineering)/.test(id)) return 'RESILIENCE';
   return null;
 }
+
+// How easily the shipped app reads back as source (MASVS-RESILIENCE). React Native JavaScript is
+// recoverable from any APK/IPA; Hermes bytecode and R8 only slow that down. The real defence is
+// keeping secrets and trust decisions off the device, so this is advice, not an alarm.
+export function reverseEngineering(root, project) {
+  const findings = [];
+  // Source maps packaged into the app give back the original code, names and comments.
+  const mapDirs = [path.join(root, 'android', 'app', 'src', 'main', 'assets'), path.join(root, 'ios')];
+  const maps = [];
+  const scan = (dir, depth) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && depth < 3 && !['Pods', 'build', 'DerivedData'].includes(e.name)) scan(path.join(dir, e.name), depth + 1);
+      else if (/\.(?:bundle|jsbundle|hbc)\.map$|^index\.android\.bundle\.map$|^main\.jsbundle\.map$/.test(e.name)) maps.push(path.relative(root, path.join(dir, e.name)));
+    }
+  };
+  for (const d of mapDirs) scan(d, 0);
+  if (maps.length) {
+    findings.push({
+      id: 'sourcemap-in-app',
+      severity: 'high',
+      area: 'security',
+      title: `A source map is packaged into the app (${maps[0]})`,
+      detail: 'Anyone who unzips the APK/IPA gets your original JavaScript with names and comments. Upload source maps to your crash reporter instead, and keep them out of the app folders. (OWASP MASVS-RESILIENCE)',
+      fix: { kind: 'security', step: `Remove \`${maps[0]}\` from the app sources (and from git), and upload source maps to the crash reporter instead.` },
+    });
+  }
+
+  const gradle = read(path.join(root, 'android', 'app', 'build.gradle')) || read(path.join(root, 'android', 'app', 'build.gradle.kts')) || '';
+  const props = read(path.join(root, 'android', 'gradle.properties')) || '';
+  const r8Off = gradle && (/enableProguardInReleaseBuilds\s*=\s*false/.test(gradle) || /release\s*\{[^}]*minifyEnabled\s*\(?\s*false/.test(gradle));
+  const hermesOff = /^\s*hermesEnabled\s*=\s*false/m.test(props) || /hermes_enabled\s*=>\s*false/.test(read(path.join(root, 'ios', 'Podfile')) || '');
+  const factors = [hermesOff && 'Hermes is off, so the JavaScript ships as readable text', r8Off && 'R8/ProGuard is off, so Java/Kotlin class and method names stay readable'].filter(Boolean);
+  if (factors.length && !project.managed) {
+    findings.push({
+      id: 'easy-reverse-engineering',
+      severity: 'low',
+      area: 'security',
+      title: 'The release build is easy to read back',
+      detail: `${factors.join('; ')}. Any React Native app can be unpacked, and obfuscation only slows that down, so never rely on it: keep secrets and checks that matter (prices, entitlements, admin flags) on the server. Turning these on is still cheap. (OWASP MASVS-RESILIENCE)`,
+      fix: { kind: 'security', step: `${hermesOff ? 'Turn on Hermes. ' : ''}${r8Off ? 'Set `enableProguardInReleaseBuilds = true` in `android/app/build.gradle` and test a release build (add keep rules for libraries that need them). ' : ''}Keep secrets and trust decisions on the server.` },
+    });
+  }
+  return findings;
+}
+
+// Secrets in Expo config: app.json/app.config `extra` ships inside the app (Constants.expoConfig),
+// EXPO_PUBLIC_ variables are compiled into the bundle, and eas.json build env is committed.
+// Names alone decide; many SDK "API keys" are public by design, so those are left alone.
+const SECRET_NAME = /(?:secret|private|password|passwd|auth[_-]?token|access[_-]?token|refresh[_-]?token|access[_-]?key|service[_-]?role|admin[_-]?key|token$)/i;
+const maskValue = (v) => (v.length <= 8 ? '****' : `${v.slice(0, 4)}…${v.slice(-2)}`);
+
+export function expoConfigSecrets(root) {
+  const findings = [];
+  const shipped = [];
+  const committed = [];
+  const looksReal = (v) => typeof v === 'string' && v.length >= 12 && !/^\$\{|^process\.env|example|placeholder|your[_-]|xxx|changeme|<.*>/i.test(v);
+
+  let app = null;
+  try {
+    app = JSON.parse(read(path.join(root, 'app.json')) || 'null');
+  } catch {
+    // not JSON
+  }
+  const extra = (app && (app.expo || app).extra) || {};
+  for (const [k, v] of Object.entries(extra)) if (SECRET_NAME.test(k) && looksReal(v)) shipped.push({ where: `app.json extra.${k}`, value: v });
+  for (const f of ['app.config.js', 'app.config.ts']) {
+    const text = read(path.join(root, f));
+    const block = text && text.match(/\bextra\s*:\s*\{([\s\S]*?)\n\s*\}/);
+    if (!block) continue;
+    for (const m of block[1].matchAll(/([A-Za-z_][\w]*)\s*:\s*['"`]([^'"`\n]{12,})['"`]/g)) {
+      if (SECRET_NAME.test(m[1]) && looksReal(m[2])) shipped.push({ where: `${f} extra.${m[1]}`, value: m[2] });
+    }
+  }
+  let eas = null;
+  try {
+    eas = JSON.parse(read(path.join(root, 'eas.json')) || 'null');
+  } catch {
+    // not JSON
+  }
+  for (const [profile, cfg] of Object.entries((eas && eas.build) || {})) {
+    for (const [k, v] of Object.entries((cfg && cfg.env) || {})) {
+      if (!SECRET_NAME.test(k) || !looksReal(v)) continue;
+      if (k.startsWith('EXPO_PUBLIC_')) shipped.push({ where: `eas.json build.${profile}.env.${k}`, value: v });
+      else committed.push({ where: `eas.json build.${profile}.env.${k}`, value: v });
+    }
+  }
+  if (shipped.length) {
+    findings.push({
+      id: 'expo-secret-shipped',
+      severity: 'high',
+      area: 'security',
+      title: `Secret-looking value${shipped.length === 1 ? '' : 's'} shipped inside the app via Expo config (${shipped[0].where})`,
+      detail: `${shipped.map((s) => `${s.where} = ${maskValue(s.value)}`).slice(0, 3).join('; ')}. Expo \`extra\` is readable from the app manifest and EXPO_PUBLIC_ variables are compiled into the bundle, so anyone with the app can read them. Revoke them and move the calls that need them to a server. (OWASP MASVS-CRYPTO)`,
+      fix: { kind: 'secret', label: 'Secret in Expo config', file: shipped[0].where.split(' ')[0], line: 1, bundled: true },
+    });
+  }
+  if (committed.length) {
+    findings.push({
+      id: 'expo-secret-committed',
+      severity: 'high',
+      area: 'security',
+      title: `Secret committed in eas.json (${committed[0].where})`,
+      detail: `${committed.map((s) => `${s.where} = ${maskValue(s.value)}`).slice(0, 3).join('; ')}. Everyone with repository access can use it (a Sentry auth token, for example, can read and change your Sentry organisation). Rotate it and store it as an EAS secret (\`eas env:create\`) instead. (OWASP MASVS-CRYPTO)`,
+      fix: { kind: 'secret', label: 'Secret in eas.json', file: 'eas.json', line: 1, bundled: false },
+    });
+  }
+  return findings;
+}

package/src/stability.js

@@ -159,6 +159,7 @@ export function stabilityChecks(project) {
   }
 
   for (const f of iosUsageDescriptions(project)) add(f);
+  for (const f of removedCoreImports(project)) add(f);
   return findings;
 }
 
@@ -246,3 +247,85 @@ export function iosUsageDescriptions(project) {
     },
   ];
 }
+
+// Components and APIs that left React Native core. Importing them from 'react-native' throws
+// ("X has been removed from react-native core", checked in RN's index.js for 0.72-0.76) or, from
+// 0.74 for the PropTypes and later for the rest, is simply undefined: a crash on first use.
+const REMOVED_FROM_CORE = {
+  AsyncStorage: '@react-native-async-storage/async-storage',
+  NetInfo: '@react-native-community/netinfo',
+  WebView: 'react-native-webview',
+  Slider: '@react-native-community/slider',
+  ListView: 'FlatList or SectionList (core)',
+  SwipeableListView: 'FlatList with a swipeable row library',
+  CameraRoll: '@react-native-camera-roll/camera-roll',
+  ImageEditor: '@react-native-community/image-editor',
+  ImageStore: 'expo-file-system or react-native-blob-util',
+  TimePickerAndroid: '@react-native-community/datetimepicker',
+  DatePickerAndroid: '@react-native-community/datetimepicker',
+  DatePickerIOS: '@react-native-community/datetimepicker',
+  ToolbarAndroid: '@react-native-community/toolbar-android',
+  ViewPagerAndroid: 'react-native-pager-view',
+  CheckBox: '@react-native-community/checkbox',
+  SegmentedControlIOS: '@react-native-segmented-control/segmented-control',
+  StatusBarIOS: 'StatusBar (core)',
+  Picker: '@react-native-picker/picker',
+  PickerIOS: '@react-native-picker/picker',
+  MaskedViewIOS: '@react-native-masked-view/masked-view',
+  ImagePickerIOS: 'react-native-image-picker',
+  ProgressViewIOS: '@react-native-community/progress-view',
+  ART: 'react-native-svg',
+};
+const REMOVED_PROP_TYPES = ['ViewPropTypes', 'ColorPropType', 'EdgeInsetsPropType', 'PointPropType'];
+
+export function removedCoreImports(project) {
+  const root = project.root;
+  const used = new Map(); // name -> first file:line
+  const files = [];
+  const walk = (dir) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory()) {
+        if (!['node_modules', '.git', 'android', 'ios', 'build', 'dist', '.expo', 'coverage', '__tests__', '__mocks__'].includes(e.name) && !e.name.startsWith('.')) walk(path.join(dir, e.name));
+      } else if (/\.[cm]?[jt]sx?$/.test(e.name) && !/\.(test|spec)\./.test(e.name)) {
+        files.push(path.join(dir, e.name));
+      }
+    }
+  };
+  walk(root);
+  for (const file of files) {
+    const text = readText(file) || '';
+    if (!text.includes("'react-native'") && !text.includes('"react-native"')) continue;
+    const blocks = [
+      ...[...text.matchAll(/import\s*(?:[\w$]+\s*,\s*)?\{([^}]*)\}\s*from\s*['"]react-native['"]/g)].map((m) => ({ names: m[1], index: m.index })),
+      ...[...text.matchAll(/(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\(\s*['"]react-native['"]\s*\)/g)].map((m) => ({ names: m[1], index: m.index })),
+    ];
+    for (const b of blocks) {
+      for (const raw of b.names.split(',')) {
+        const name = raw.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0].trim();
+        if ((REMOVED_FROM_CORE[name] || REMOVED_PROP_TYPES.includes(name)) && !used.has(name)) {
+          used.set(name, `${path.relative(root, file)}:${text.slice(0, b.index).split('\n').length}`);
+        }
+      }
+    }
+  }
+  if (!used.size) return [];
+  const minor = project.rnVersion ? Number(project.rnVersion.split('.')[1]) : null;
+  const crashesNow = [...used.keys()].some((n) => (REMOVED_PROP_TYPES.includes(n) ? minor >= 74 : minor >= 72));
+  const list = [...used].map(([n, at]) => `${n} (${at}) → ${REMOVED_FROM_CORE[n] || 'deprecated-react-native-prop-types'}`);
+  return [
+    {
+      id: 'crash-removed-core-imports',
+      severity: crashesNow ? 'high' : 'medium',
+      area: 'crash',
+      title: `${used.size} import${used.size === 1 ? '' : 's'} of APIs removed from React Native core${crashesNow ? '' : ' (they break when you upgrade)'}`,
+      detail: `${list.slice(0, 6).join('; ')}${list.length > 6 ? '; …' : ''}. Importing these from 'react-native' throws "has been removed from react-native core" or returns undefined on current versions, which crashes the screen that uses them. Install the replacement and change the import.`,
+      fix: { kind: 'crash', step: `Move ${[...used.keys()].map((n) => `\`${n}\``).join(', ')} off 'react-native' to their community packages (${[...new Set([...used.keys()].map((n) => REMOVED_FROM_CORE[n] || 'deprecated-react-native-prop-types'))].slice(0, 4).join(', ')}).` },
+    },
+  ];
+}