nativekeel 0.1.14 → 0.1.16

package/README.md

@@ -6,36 +6,46 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. **0.1.13:** performance traps (nested lists, JS-thread animations, release console logs, heavy imports, oversized images) and reverse-engineering exposure (source maps in the app, Hermes/R8 off). **0.1.12:** hacking risks mapped to OWASP MASVS: open Firebase rules, TLS certificate checks turned off, hardcoded keys and weak crypto, tokens in plain storage, with a security overview in every report. **0.1.10:** every report opens with *Start here*, the three most urgent first steps; missing iOS permission texts (a crash and an App Review rejection) are caught. Recent releases added known vulnerabilities in the exact versions you ship, password leaks into logs and databases, unsafe WebViews, open Android components, plain-HTTP API calls and runtime crash risks. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
-
-It answers the questions that decide whether your app can still ship:
-
-- **Is your React Native / Expo version still supported?** React Native supports the latest minor and the two before it.
-- **Can you upgrade at all?** The legacy architecture was removed in 0.82. If the New Architecture is off, you are stuck at 0.81.
-- **Which packages block the upgrade?** Native modules without New Architecture support, unmaintained or with no release in years, with known alternatives. Outdated "unmaintained" flags are cross-checked against the latest npm release.
-- **What can you simply delete?** Packages that are installed but never imported, referenced natively or required by another package. Every one you remove is one you never upgrade.
-- **Will the stores accept your next build?** Google Play `targetSdk` and 16 KB page size (it opens your built APK/AAB and checks the alignment of every native library), and the iOS privacy manifest.
-- **Are secrets shipped inside your app?** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth keys, private keys and Supabase `service_role` keys (anon keys are fine), plus `.env` values that `react-native-config` or `EXPO_PUBLIC_` compile into the bundle, and secrets in Expo `extra` or `eas.json`. Server-side folders are reported separately.
-- **Is transport security off?** Cleartext HTTP or `debuggable` in the release Android manifest, `NSAllowsArbitraryLoads` on iOS.
-- **Do you ship known vulnerabilities?** Advisories from the GitHub Advisory Database for the exact versions in your lockfile or `node_modules`. Advisories that only affect Node.js servers are kept, at low severity.
-- **Can someone break in?** Grouped by OWASP MASVS: Firebase Realtime Database/Firestore/Storage rules open to anyone (or in test mode), TLS certificate checks turned off in native code, hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode, `Math.random` for nonces and salts. These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app would.
-- **Can someone read your users' data?** Passwords that flow into crash reports, analytics, remote databases or plain AsyncStorage (followed through intermediate variables), WebViews that let page scripts read local files or load HTTP into HTTPS, Android backups that copy tokens, Android components any app can start, API calls over plain HTTP, auth tokens in unencrypted storage.
-- **Is it slow or heavy?** A FlatList inside a ScrollView (no virtualization), animations with `useNativeDriver: false`, `console.log` left in release builds, whole-library `lodash`/`moment` imports, images over 500 KB that the app requires. Static signs to measure on a device, not a profiler.
-- **Can it be taken apart?** Source maps packaged into the app, Hermes or R8 off in release (OWASP MASVS-RESILIENCE). Obfuscation only slows an attacker down; keep secrets and checks on the server.
-- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist description iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …).
-- **Leftovers from old templates?** Flipper, JavaScriptCore instead of Hermes.
+**What's new in 0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). **0.1.15:** run it at a monorepo root and it lists the app folders to scan. **0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
-✖ CRITICAL React Native 0.77.1 is no longer supported
-           Latest is 0.87.1. You are 10 minor versions behind; only the latest 3 minors receive fixes.
-✖ CRITICAL New Architecture is disabled (android + ios)
-           The legacy architecture was removed in 0.82. This app cannot upgrade past 0.81 until it migrates.
-✖ CRITICAL AWS secret access key shipped inside the app (src/aws.js:4)
-           Value wJal…EY. Anyone who downloads the app can extract it. Revoke it now, then move the call to a server.
-▲ HIGH     react-native-fast-image: no New Architecture support, unmaintained
-           Likely upgrade blocker. Alternatives: expo-image.
+Summary  4 critical · 5 high · 4 medium · 6 low
+Security (OWASP MASVS)  crypto 1 · network 1  ·  7 groups checked
+
+Start here
+  1. Revoke the AWS access key ID in src/App.js:6 at the provider today.
+  2. Set targetSdkVersion = 36 and compileSdkVersion = 36 in android/build.gradle.
+  3. Run pod install, commit the generated PrivacyInfo.xcprivacy, and add your data types.
 ```
 
+## What it checks
+
+**Upgrade**
+- **Is your React Native / Expo version still supported?** React Native supports the latest three minors; in Expo projects React Native moves with the SDK.
+- **Can you upgrade at all?** The legacy architecture was removed in 0.82. If the New Architecture is off (it is off by default before 0.76), you are stuck at 0.81.
+- **Which packages block the upgrade?** Native modules without New Architecture support (cross-checked with the package's own codegen spec), unmaintained or with no release in years, with verified alternatives and renamed packages. Library versions for each step come from the libraries' own compatibility tables.
+- **What can you simply delete?** Installed packages that nothing imports, references natively, requires or patches.
+
+**Store**
+- **Will Google Play and the App Store accept your next build?** `targetSdk`, 16 KB memory pages (it also opens your built APK/AAB and checks every native library), the iOS privacy manifest, and missing Info.plist usage descriptions.
+
+**Crashes**
+- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist text iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …), and traps learned from real upgrades.
+
+**Security, grouped by OWASP MASVS**
+- **Secrets in the app or the repo:** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth and Supabase `service_role` keys, private keys, `.env` values compiled into the bundle, Expo `extra`/`EXPO_PUBLIC_`/`eas.json` secrets, signing keys and passwords.
+- **Data on the device:** passwords that flow into crash reports, analytics, databases or plain AsyncStorage (followed through variables), auth tokens in unencrypted storage, Android backups that copy them.
+- **Network:** TLS certificate checks turned off in native code, cleartext HTTP, `NSAllowsArbitraryLoads`, plain-HTTP API calls, user-installed CAs in release.
+- **Backend rules:** Firebase Realtime Database, Firestore and Storage rules open to anyone or in test mode.
+- **Cryptography:** hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode, `Math.random` for nonces and salts.
+- **Platform:** WebViews that read local files or load HTTP into HTTPS, Android components any app can start, unverified deep links and the template `myapp://` URL scheme.
+- **Dependencies and reverse engineering:** known vulnerabilities in the exact versions you ship (GitHub Advisory Database), source maps in the app, Hermes or R8 off.
+
+These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app and backend would.
+
+**Performance**
+- **Is it slow or heavy?** A FlatList inside a ScrollView (no virtualization), animations with `useNativeDriver: false`, `console.log` left in release builds, whole-library `lodash`/`moment` imports, images over 500 KB that the app requires.
+
 ## Usage
 
 ```sh
@@ -54,7 +64,7 @@ Everything is free. The scan exits with code `1` when it finds a critical issue,
 
 ### Upgrade plan
 
-`nativekeel plan` turns the report into ordered work: stop leaks first, replace blocking packages, switch on the New Architecture on your current version, then upgrade React Native in small, reviewable hops with links to the Upgrade Helper diffs.
+`nativekeel plan` turns the report into ordered work: stop leaks, set up a safety net of UI flows, fix crash risks, meet store deadlines, close security gaps, replace blocking packages, switch on the New Architecture at the right point, then upgrade React Native (or the Expo SDK) in small, reviewable hops with links to the Upgrade Helper diffs and the library versions each hop needs. Performance fixes and routine updates come last.
 
 ### GitHub Action
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -6,7 +6,7 @@ import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
 import { stabilityChecks } from './stability.js';
 import { performanceChecks } from './performance.js';
-import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, masvsOf, MASVS_GROUPS } from './security.js';
+import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, deepLinks, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
@@ -408,7 +408,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   for (const f of performanceChecks(project)) add(f);
 
   // Security beyond leaked keys.
-  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root)]) add(f);
+  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root), ...deepLinks(project.root, project.deps)]) add(f);
   if (!forcedOffline) {
     // Exact versions only (installed, else the lockfile): a range would be a guess.
     const locked = lockedVersions(project.root, project.deps);

package/src/native.js

@@ -200,7 +200,8 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
     patched.push({ file: f, pkg, version });
     const text = read(path.join(patchDir, f)) || '';
     const buildPaths = (text.match(/^diff --git a\/node_modules\/\S+?\/(?:android|ios)\/(?:build|\.cxx|\.gradle)\//gm) || []).length;
-    const binary = /^GIT binary patch|^Binary files /m.test(text);
+    // Finder/Explorer junk (.DS_Store, Thumbs.db) caught in a patch is harmless noise.
+    const binary = text.split(/^diff --git /m).some((part) => /^GIT binary patch|^Binary files /m.test(part) && !/^\S*?(?:\.DS_Store|Thumbs\.db)\b/.test(part));
     if (buildPaths || binary) {
       add({
         id: `patch-artifacts:${f}`,
@@ -400,7 +401,7 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         return false;
       }
     };
-    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug/i.test(path.basename(f)) && nonEmpty(f));
+    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug|fake|dummy/i.test(path.basename(f)) && !/(?:^|\/)(?:__tests__|tests?|e2e|fixtures?)\//.test(f) && nonEmpty(f));
     for (const f of signing) {
       add({
         id: `signing-keystore:${f}`,

package/src/plan.js

@@ -586,7 +586,7 @@ export function buildPlan(result) {
 export function planToMarkdown(result, plan) {
   const p = result.project;
   const lines = [
-    `# Upgrade plan: ${p.name || 'your app'}`,
+    `# ${plan.phases.some((ph) => /^Upgrade (React Native|Expo SDK)/.test(ph.title)) ? 'Upgrade plan' : 'Action plan'}: ${p.name || 'your app'}`,
     '',
     `Generated by NativeKeel on ${result.scannedAt.slice(0, 10)}.  `,
     `React Native ${p.reactNative || '-'}${p.expo ? ` · Expo ${p.expo}` : ''} → latest ${result.latest.reactNative || '-'}.  `,

package/src/project.js

@@ -126,6 +126,10 @@ export function loadProject(root) {
   const devDeps = resolveCatalogRefs({ ...(pkg.devDependencies || {}) }, catalogs);
   const declared = (name) => deps[name] || devDeps[name];
   if (!declared('react-native') && !declared('expo')) {
+    const apps = findAppFolders(root);
+    if (apps.length) {
+      throw new Error(`This folder is not a React Native app, but it contains ${apps.length === 1 ? 'one' : apps.length}:\n${apps.slice(0, 8).map((a) => `  npx nativekeel ${a}`).join('\n')}${apps.length > 8 ? '\n  …' : ''}`);
+    }
     throw new Error('This does not look like a React Native app (no react-native or expo dependency). Run it inside your app folder.');
   }
 
@@ -193,3 +197,31 @@ function detectAndroid(root) {
   };
   return { targetSdk: num('targetSdk'), compileSdk: num('compileSdk'), minSdk: num('minSdk') };
 }
+
+// React Native / Expo app folders below `root` (monorepos: apps/mobile, packages/app, …), as
+// relative paths. Libraries (react-native as a peer) are left out.
+export function findAppFolders(root, maxDepth = 3) {
+  const out = [];
+  const skip = new Set(['node_modules', '.git', 'Pods', 'build', 'dist', '.expo', 'android', 'ios', 'vendor', 'example', 'examples', 'docs', 'website', 'e2e', 'test', 'tests']);
+  const visit = (dir, depth) => {
+    if (depth > maxDepth) return;
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (!e.isDirectory() || skip.has(e.name) || e.name.startsWith('.')) continue;
+      const sub = path.join(dir, e.name);
+      const pkg = readJson(path.join(sub, 'package.json'));
+      const deps = pkg ? { ...pkg.dependencies, ...pkg.devDependencies } : {};
+      const isApp = pkg && (deps['react-native'] || deps.expo) && !(pkg.peerDependencies && pkg.peerDependencies['react-native']) &&
+        ['android', 'ios', 'app.json', 'app.config.js', 'app.config.ts'].some((f) => fs.existsSync(path.join(sub, f)));
+      if (isApp) out.push(path.relative(root, sub));
+      else visit(sub, depth + 1);
+    }
+  };
+  visit(root, 1);
+  return out.sort();
+}

package/src/report-html.js

@@ -32,7 +32,7 @@ export function htmlReport(result, { brand = null, plan = null } = {}) {
     : '';
 
   const planHtml = plan
-    ? `<section><h2>Upgrade plan <small>scope: ${esc(plan.complexity.size)}</small></h2>${plan.phases
+    ? `<section><h2>${plan.phases.some((ph) => /^Upgrade (React Native|Expo SDK)/.test(ph.title)) ? 'Upgrade plan' : 'Action plan'} <small>scope: ${esc(plan.complexity.size)}</small></h2>${plan.phases
         .map((ph, i) => `<h3>${i + 1}. ${esc(ph.title)}</h3><p class="why">${esc(ph.why)}</p><ul>${ph.steps.map((s) => `<li>${rich(s)}</li>`).join('')}</ul>`)
         .join('')}</section>`
     : '';
@@ -60,6 +60,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .stat.critical b{color:var(--critical)}.stat.high b{color:var(--high)}
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
+main{overflow-wrap:anywhere}code{overflow-wrap:anywhere;word-break:break-word}.f>div,.sg,.stats>*{min-width:0}.facts{display:flex;flex-wrap:wrap;gap:6px 16px}
 .start{background:var(--card);border:1px solid var(--line);border-left:4px solid var(--accent);border-radius:8px;padding:6px 18px 10px;margin-top:20px}.start h2{margin:10px 0 6px}.start li{margin:6px 0}
 .secgrid{display:grid;grid-template-columns:repeat(3,1fr);gap:8px}.sg{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:10px 12px;display:flex;flex-direction:column}.sg b{font-size:20px}.sg.ok b{color:var(--accent)}.sg.bad b{color:var(--critical)}.sg small{color:var(--muted)}@media (max-width:560px){.secgrid{grid-template-columns:1fr 1fr}}
 details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}

package/src/security.js

@@ -591,7 +591,7 @@ export function masvsOf(id) {
   if (/^(secret:|env-bundled|crypto-|expo-secret)/.test(id)) return 'CRYPTO';
   if (/^(password-leak|token-unencrypted|android-allow-backup)/.test(id)) return 'STORAGE';
   if (/^(insecure-tls|user-certificates|plain-http|ios-ats|android-cleartext)/.test(id)) return 'NETWORK';
-  if (/^(webview-|android-exported)/.test(id)) return 'PLATFORM';
+  if (/^(webview-|android-exported|deeplink-)/.test(id)) return 'PLATFORM';
   if (/^firebase-/.test(id)) return 'AUTH';
   if (/^(vuln:|signing-|android-debuggable)/.test(id)) return 'CODE';
   if (/^(sourcemap-in-app|easy-reverse-engineering)/.test(id)) return 'RESILIENCE';
@@ -711,3 +711,94 @@ export function expoConfigSecrets(root) {
   }
   return findings;
 }
+
+// Deep links (MASVS-PLATFORM). A web link (https://your.domain/...) opens the app only when the
+// domain is verified (autoVerify + assetlinks.json); without it Android 12+ opens the browser,
+// and older Android lets any app that registers the same link receive it. Custom URL schemes can
+// be registered by any app, so the template scheme "myapp" is shared with every other app that
+// kept it, and an OAuth redirect to it can land in the wrong app.
+const TEMPLATE_SCHEMES = new Set(['myapp', 'my-app', 'myscheme', 'your-app-scheme', 'yourappscheme']);
+const SENSITIVE_LINK = /auth|login|signin|sign-in|reset|verify|magic|invite|oauth|callback|token/i;
+const OAUTH_DEPS = ['expo-auth-session', '@clerk/clerk-expo', 'react-native-app-auth', '@react-native-community/oauth', 'react-native-auth0'];
+
+export function deepLinks(root, deps = {}) {
+  const findings = [];
+  const unverified = new Map(); // host -> sensitive?
+  const schemes = new Set();
+  const realHost = (h) => h && !/[*$@{]/.test(h) && h.includes('.') && !/^(?:localhost|127\.|10\.|192\.168\.)/.test(h);
+
+  // autoVerify on any one filter makes Android verify every web host in the manifest.
+  const manifest = read(path.join(root, 'android', 'app', 'src', 'main', 'AndroidManifest.xml')) || '';
+  const anyVerified = /<intent-filter\b[^>]*android:autoVerify\s*=\s*"true"/.test(manifest);
+  for (const m of manifest.matchAll(/<intent-filter\b([^>]*)>([\s\S]*?)<\/intent-filter>/g)) {
+    const body = m[2];
+    if (!/android\.intent\.category\.BROWSABLE/.test(body)) continue;
+    const found = [...body.matchAll(/android:scheme\s*=\s*"([^"]+)"/g)].map((x) => x[1]);
+    for (const s of found) if (!/^https?$/.test(s)) schemes.add(s.toLowerCase());
+    if (anyVerified || !found.some((s) => /^https?$/.test(s))) continue;
+    const paths = [...body.matchAll(/android:path(?:Prefix|Pattern)?\s*=\s*"([^"]+)"/g)].map((x) => x[1]).join(' ');
+    for (const h of body.matchAll(/android:host\s*=\s*"([^"]+)"/g)) {
+      if (realHost(h[1])) unverified.set(h[1], unverified.get(h[1]) || SENSITIVE_LINK.test(`${h[1]} ${paths}`));
+    }
+  }
+
+  let app = null;
+  try {
+    app = JSON.parse(read(path.join(root, 'app.json')) || 'null');
+  } catch {
+    // not JSON
+  }
+  const expo = (app && (app.expo || app)) || {};
+  for (const s of [].concat(expo.scheme || [])) if (typeof s === 'string') schemes.add(s.toLowerCase());
+  for (const f of ['app.config.js', 'app.config.ts']) {
+    const text = read(path.join(root, f)) || '';
+    for (const m of text.matchAll(/\bscheme\s*:\s*['"`]([\w.+-]+)['"`]/g)) schemes.add(m[1].toLowerCase());
+  }
+  const expoFilters = (expo.android && expo.android.intentFilters) || [];
+  for (const filter of expoFilters.some((f) => f && f.autoVerify) ? [] : expoFilters) {
+    if (!filter || ![].concat(filter.category || []).includes('BROWSABLE')) continue;
+    for (const d of [].concat(filter.data || [])) {
+      if (d && /^https?$/.test(d.scheme || '') && realHost(d.host)) {
+        unverified.set(d.host, unverified.get(d.host) || SENSITIVE_LINK.test(`${d.host} ${d.pathPrefix || ''} ${d.path || ''} ${d.pathPattern || ''}`));
+      }
+    }
+  }
+  let iosDirs = [];
+  try {
+    iosDirs = fs.readdirSync(path.join(root, 'ios'), { withFileTypes: true }).filter((e) => e.isDirectory() && !/^(?:Pods|build)$|Tests$|\.xc/.test(e.name));
+  } catch {
+    // no ios folder
+  }
+  for (const d of iosDirs) {
+    const plist = read(path.join(root, 'ios', d.name, 'Info.plist')) || '';
+    for (const block of plist.match(/<key>CFBundleURLSchemes<\/key>\s*<array>[\s\S]*?<\/array>/g) || []) {
+      for (const s of block.matchAll(/<string>([^<$]+)<\/string>/g)) schemes.add(s[1].toLowerCase());
+    }
+  }
+
+  if (unverified.size) {
+    const hosts = [...unverified.keys()];
+    const sensitive = hosts.filter((h) => unverified.get(h));
+    findings.push({
+      id: 'deeplink-unverified',
+      severity: sensitive.length ? 'medium' : 'low',
+      area: 'security',
+      title: `Web links to ${hosts.slice(0, 2).join(', ')}${hosts.length > 2 ? ` and ${hosts.length - 2} more` : ''} are not verified (no autoVerify)`,
+      detail: `On Android 12+ these links open in the browser instead of the app, and on older Android any installed app that registers the same links can receive them${sensitive.length ? ', including the login/reset/invite links that carry tokens' : ''}. For domains you own, add android:autoVerify="true" to the intent filter and publish /.well-known/assetlinks.json with your signing certificate. (OWASP MASVS-PLATFORM)`,
+      fix: { kind: 'security', step: `Add \`android:autoVerify="true"\` to the https intent filters for ${hosts.slice(0, 3).map((h) => `\`${h}\``).join(', ')} and serve \`https://${hosts[0]}/.well-known/assetlinks.json\`.` },
+    });
+  }
+  const template = [...schemes].filter((s) => TEMPLATE_SCHEMES.has(s));
+  if (template.length) {
+    const oauth = OAUTH_DEPS.filter((d) => deps[d]);
+    findings.push({
+      id: 'deeplink-template-scheme',
+      severity: oauth.length ? 'medium' : 'low',
+      area: 'security',
+      title: `The app still uses the template URL scheme "${template[0]}://"`,
+      detail: `Many other apps kept the same scheme, so ${template[0]}:// links can open a different app${oauth.length ? `, and the sign-in redirect of ${oauth.join(', ')} can be delivered to it` : ''}. Pick a scheme unique to your app (for example your bundle identifier). (OWASP MASVS-PLATFORM)`,
+      fix: { kind: 'security', step: `Replace the "${template[0]}" scheme with one unique to the app (app.json \`scheme\`, AndroidManifest and Info.plist), and update redirect URIs registered with your sign-in providers.` },
+    });
+  }
+  return findings;
+}