nativekeel 0.1.15 → 0.1.17

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.15:** run it at a monorepo root and it lists the app folders to scan. **0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.17:** every vulnerable package shows the version that fixes it, and Expo apps get one line for the packages the SDK upgrade moves instead of a long list. **0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low
@@ -38,7 +38,7 @@ Start here
 - **Network:** TLS certificate checks turned off in native code, cleartext HTTP, `NSAllowsArbitraryLoads`, plain-HTTP API calls, user-installed CAs in release.
 - **Backend rules:** Firebase Realtime Database, Firestore and Storage rules open to anyone or in test mode.
 - **Cryptography:** hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode, `Math.random` for nonces and salts.
-- **Platform:** WebViews that read local files or load HTTP into HTTPS, Android components any app can start.
+- **Platform:** WebViews that read local files or load HTTP into HTTPS, Android components any app can start, unverified deep links and the template `myapp://` URL scheme.
 - **Dependencies and reverse engineering:** known vulnerabilities in the exact versions you ship (GitHub Advisory Database), source maps in the app, Hermes or R8 off.
 
 These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app and backend would.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -6,8 +6,9 @@ import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
 import { stabilityChecks } from './stability.js';
 import { performanceChecks } from './performance.js';
-import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, masvsOf, MASVS_GROUPS } from './security.js';
+import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, deepLinks, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
+import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
 import { COMPAT, bestRange, checkCompat } from './compat.js';
@@ -232,6 +233,8 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   const codegen = forcedOffline ? {} : await registry.codegenSupport(archSuspects.map((n) => ({ name: n, version: versionOf(n) })));
 
   const deps = [];
+  let pinnedCache = null;
+  const expoPinned = () => (pinnedCache ||= expoPinnedNames(project.root));
   for (const name of names) {
     const dir = directory[name];
     const version = versionOf(name);
@@ -296,13 +299,15 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       });
     }
     if (!noNewArch && !dep.unmaintained && !stale && version && dep.latest && lineOf(version) !== lineOf(dep.latest)) {
+      // In Expo apps the SDK decides these versions: the SDK upgrade moves them, no separate work.
+      const expoManaged = !!project.expoVersion && movesWithExpoSdk(name, expoPinned());
       add({
         id: `dep-major:${name}`,
-        severity: 'low',
+        severity: expoManaged ? 'info' : 'low',
         area: 'dependency',
         title: `${name} ${version} → ${dep.latest}`,
-        detail: 'Major version behind.',
-        fix: { kind: 'bump-dep', name, from: version, to: dep.latest, native },
+        detail: expoManaged ? 'Major version behind; the Expo SDK upgrade moves it.' : 'Major version behind.',
+        fix: { kind: 'bump-dep', name, from: version, to: dep.latest, native, expoManaged },
       });
     }
   }
@@ -408,7 +413,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   for (const f of performanceChecks(project)) add(f);
 
   // Security beyond leaked keys.
-  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root)]) add(f);
+  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root), ...deepLinks(project.root, project.deps)]) add(f);
   if (!forcedOffline) {
     // Exact versions only (installed, else the lockfile): a range would be a guess.
     const locked = lockedVersions(project.root, project.deps);

package/src/expo-pins.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
+// app's own copy of that file is installed it is used instead; this list covers scans without
+// node_modules.
+const EXPO_PINNED = new Set([
+  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
+  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
+  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
+  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
+  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
+  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
+]);
+
+export function expoPinnedNames(root) {
+  try {
+    let dir = root;
+    while (true) {
+      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
+      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
+      const parent = path.dirname(dir);
+      if (parent === dir) return EXPO_PINNED;
+      dir = parent;
+    }
+  } catch {
+    return EXPO_PINNED;
+  }
+}
+
+// Packages an Expo SDK upgrade moves on its own (`npx expo install --fix`): no separate work.
+export function movesWithExpoSdk(name, pinned) {
+  return /^(expo-|@expo\/)/.test(name) || ['expo', 'jest-expo', 'react-native', 'react', 'react-dom'].includes(name) || pinned.has(name);
+}

package/src/native.js

@@ -200,7 +200,8 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
     patched.push({ file: f, pkg, version });
     const text = read(path.join(patchDir, f)) || '';
     const buildPaths = (text.match(/^diff --git a\/node_modules\/\S+?\/(?:android|ios)\/(?:build|\.cxx|\.gradle)\//gm) || []).length;
-    const binary = /^GIT binary patch|^Binary files /m.test(text);
+    // Finder/Explorer junk (.DS_Store, Thumbs.db) caught in a patch is harmless noise.
+    const binary = text.split(/^diff --git /m).some((part) => /^GIT binary patch|^Binary files /m.test(part) && !/^\S*?(?:\.DS_Store|Thumbs\.db)\b/.test(part));
     if (buildPaths || binary) {
       add({
         id: `patch-artifacts:${f}`,
@@ -400,7 +401,7 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         return false;
       }
     };
-    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug/i.test(path.basename(f)) && nonEmpty(f));
+    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug|fake|dummy/i.test(path.basename(f)) && !/(?:^|\/)(?:__tests__|tests?|e2e|fixtures?)\//.test(f) && nonEmpty(f));
     for (const f of signing) {
       add({
         id: `signing-keystore:${f}`,

package/src/plan.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { UPGRADE_HELPER_URL, NEW_ARCH_ONLY_MINOR } from './rules.js';
 import { SITE_URL } from './config.js';
 import { COMPAT, bestRange } from './compat.js';
+import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 
 // Turns a scan result into an ordered upgrade plan. The order matters more than the steps:
 // stop leaks first, then remove blockers, switch architecture on the current version,
@@ -145,40 +146,13 @@ function safetyNetPhase(tool) {
   };
 }
 
-// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
-// app's own copy of that file is installed it is used instead; this list covers scans without
-// node_modules.
-const EXPO_PINNED = new Set([
-  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
-  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
-  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
-  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
-  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
-  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
-]);
-
-function expoPinnedNames(root) {
-  try {
-    let dir = root;
-    while (true) {
-      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
-      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
-      const parent = path.dirname(dir);
-      if (parent === dir) return EXPO_PINNED;
-      dir = parent;
-    }
-  } catch {
-    return EXPO_PINNED;
-  }
-}
-
 export function buildPlan(result) {
   const isExpo = !!result.project.expo;
   const basePm = commands[packageManager(result.project.root)];
   // In Expo projects `npx expo install` picks the version that matches the SDK.
   const pm = isExpo ? { ...basePm, add: 'npx expo install' } : basePm;
   const pinned = isExpo ? expoPinnedNames(result.project.root) : new Set();
-  const movesWithExpo = (name) => isExpo && (/^(expo-|@expo\/)/.test(name) || ['expo', 'jest-expo', 'react-native', 'react', 'react-dom'].includes(name) || pinned.has(name));
+  const movesWithExpo = (name) => isExpo && movesWithExpoSdk(name, pinned);
   const installed = new Set(result.deps.map((d) => d.name));
   const byKind = (kind) => result.findings.filter((f) => f.fix && f.fix.kind === kind).map((f) => f.fix);
   const phases = [];
@@ -289,7 +263,7 @@ export function buildPlan(result) {
       sec.push({ sev, step: f.fix.step });
     } else if (f.fix.kind === 'vuln-dep' && (f.fix.severity === 'critical' || f.fix.severity === 'high')) {
       const v = f.fix;
-      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to} or later` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
+      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
     }
   }
   const securitySteps = sec.sort((a, b) => a.sev - b.sev).map((x) => x.step);

package/src/report-html.js

@@ -26,8 +26,8 @@ export function htmlReport(result, { brand = null, plan = null } = {}) {
   ).join('\n');
   const bumps = result.findings.filter(isBump);
   const bumpTable = bumps.length
-    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind <span class="muted">(low)</span></summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
-        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${f.fix.native ? 'native' : ''}</td></tr>`)
+    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind${bumps.some((f) => f.fix.expoManaged) ? ` <span class="muted">(${bumps.filter((f) => f.fix.expoManaged).length} move with the Expo SDK upgrade)</span>` : ' <span class="muted">(low)</span>'}</summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
+        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${[f.fix.native && 'native', f.fix.expoManaged && 'moves with Expo SDK'].filter(Boolean).join(', ')}</td></tr>`)
         .join('')}</tbody></table></details>`
     : '';
 
@@ -60,6 +60,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .stat.critical b{color:var(--critical)}.stat.high b{color:var(--high)}
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
+main{overflow-wrap:anywhere}code{overflow-wrap:anywhere;word-break:break-word}.f>div,.sg,.stats>*{min-width:0}.facts{display:flex;flex-wrap:wrap;gap:6px 16px}
 .start{background:var(--card);border:1px solid var(--line);border-left:4px solid var(--accent);border-radius:8px;padding:6px 18px 10px;margin-top:20px}.start h2{margin:10px 0 6px}.start li{margin:6px 0}
 .secgrid{display:grid;grid-template-columns:repeat(3,1fr);gap:8px}.sg{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:10px 12px;display:flex;flex-direction:column}.sg b{font-size:20px}.sg.ok b{color:var(--accent)}.sg.bad b{color:var(--critical)}.sg small{color:var(--muted)}@media (max-width:560px){.secgrid{grid-template-columns:1fr 1fr}}
 details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}

package/src/report-text.js

@@ -50,10 +50,17 @@ export function textReport(result, { color = true, verbose = false } = {}) {
       out.push('');
       continue;
     }
-    for (const f of group) {
+    // Packages the Expo SDK upgrade moves: one line, they are not separate work.
+    const expoMoves = group.filter((f) => f.fix && f.fix.expoManaged);
+    for (const f of group.filter((x) => !(x.fix && x.fix.expoManaged))) {
       out.push(`${label[sev]} ${c.bold(f.title)}`);
       out.push(c.gray(indent + f.detail));
     }
+    if (expoMoves.length) {
+      const names = expoMoves.map((f) => f.fix.name);
+      out.push(`${label[sev]} ${c.bold(`${expoMoves.length} package${expoMoves.length === 1 ? '' : 's'} move with the Expo SDK upgrade`)}`);
+      out.push(c.gray(`${indent}${(verbose ? names : names.slice(0, 6)).join(', ')}${!verbose && names.length > 6 ? `, … (${names.length - 6} more with --verbose)` : ''}. \`npx expo install --fix\` sets the versions the new SDK expects.`));
+    }
     out.push('');
   }
 

package/src/security.js

@@ -33,7 +33,7 @@ const read = (file) => {
   }
 };
 
-const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bssr\b/i;
+const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bhttp\/2\b|\bssr\b|\bssrf\b|no_proxy|proxy-authorization|cloud metadata/i;
 const SEVERITY = { critical: 'critical', high: 'high', moderate: 'medium', low: 'low', info: 'low' };
 const RANK = ['low', 'medium', 'high', 'critical'];
 
@@ -65,8 +65,8 @@ export async function vulnerableDependencies(registry, versions) {
       id: `vuln:${name}`,
       severity,
       area: 'security',
-      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}`,
-      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn} or later.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
+      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}${fixedIn ? ` (fixed in ${fixedIn})` : ''}`,
+      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn}${fixedIn.startsWith('a release') ? '' : ' or later'}.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
       fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, severity },
     });
   }
@@ -87,15 +87,17 @@ function applies(version, range) {
   });
 }
 
+// The lowest version outside every advisory's range. "<1.2.3" is fixed in 1.2.3; "<=1.2.2" only
+// says "after 1.2.2", which counts when it is the highest bound.
 function minimumFixed(advisories) {
   let fixed = null;
   for (const a of advisories) {
-    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<\s*(\d+\.\d+\.\d+)/g)].map((m) => m[1]);
+    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<(=?)\s*(\d+\.\d+\.\d+)/g)].map((m) => ({ v: m[2], after: m[1] === '=' }));
     if (!bounds.length) return null; // an advisory without a fixed version
-    const hi = bounds.sort(compareVersions).at(-1);
-    if (!fixed || compareVersions(hi, fixed) > 0) fixed = hi;
+    const hi = bounds.sort((x, y) => compareVersions(x.v, y.v) || (x.after ? 1 : -1)).at(-1);
+    if (!fixed || compareVersions(hi.v, fixed.v) > 0 || (compareVersions(hi.v, fixed.v) === 0 && hi.after)) fixed = hi;
   }
-  return fixed;
+  return fixed && (fixed.after ? `a release after ${fixed.v}` : fixed.v);
 }
 
 // A password (or the variables built from it) passed to a log, crash report, analytics event,
@@ -591,7 +593,7 @@ export function masvsOf(id) {
   if (/^(secret:|env-bundled|crypto-|expo-secret)/.test(id)) return 'CRYPTO';
   if (/^(password-leak|token-unencrypted|android-allow-backup)/.test(id)) return 'STORAGE';
   if (/^(insecure-tls|user-certificates|plain-http|ios-ats|android-cleartext)/.test(id)) return 'NETWORK';
-  if (/^(webview-|android-exported)/.test(id)) return 'PLATFORM';
+  if (/^(webview-|android-exported|deeplink-)/.test(id)) return 'PLATFORM';
   if (/^firebase-/.test(id)) return 'AUTH';
   if (/^(vuln:|signing-|android-debuggable)/.test(id)) return 'CODE';
   if (/^(sourcemap-in-app|easy-reverse-engineering)/.test(id)) return 'RESILIENCE';
@@ -711,3 +713,94 @@ export function expoConfigSecrets(root) {
   }
   return findings;
 }
+
+// Deep links (MASVS-PLATFORM). A web link (https://your.domain/...) opens the app only when the
+// domain is verified (autoVerify + assetlinks.json); without it Android 12+ opens the browser,
+// and older Android lets any app that registers the same link receive it. Custom URL schemes can
+// be registered by any app, so the template scheme "myapp" is shared with every other app that
+// kept it, and an OAuth redirect to it can land in the wrong app.
+const TEMPLATE_SCHEMES = new Set(['myapp', 'my-app', 'myscheme', 'your-app-scheme', 'yourappscheme']);
+const SENSITIVE_LINK = /auth|login|signin|sign-in|reset|verify|magic|invite|oauth|callback|token/i;
+const OAUTH_DEPS = ['expo-auth-session', '@clerk/clerk-expo', 'react-native-app-auth', '@react-native-community/oauth', 'react-native-auth0'];
+
+export function deepLinks(root, deps = {}) {
+  const findings = [];
+  const unverified = new Map(); // host -> sensitive?
+  const schemes = new Set();
+  const realHost = (h) => h && !/[*$@{]/.test(h) && h.includes('.') && !/^(?:localhost|127\.|10\.|192\.168\.)/.test(h);
+
+  // autoVerify on any one filter makes Android verify every web host in the manifest.
+  const manifest = read(path.join(root, 'android', 'app', 'src', 'main', 'AndroidManifest.xml')) || '';
+  const anyVerified = /<intent-filter\b[^>]*android:autoVerify\s*=\s*"true"/.test(manifest);
+  for (const m of manifest.matchAll(/<intent-filter\b([^>]*)>([\s\S]*?)<\/intent-filter>/g)) {
+    const body = m[2];
+    if (!/android\.intent\.category\.BROWSABLE/.test(body)) continue;
+    const found = [...body.matchAll(/android:scheme\s*=\s*"([^"]+)"/g)].map((x) => x[1]);
+    for (const s of found) if (!/^https?$/.test(s)) schemes.add(s.toLowerCase());
+    if (anyVerified || !found.some((s) => /^https?$/.test(s))) continue;
+    const paths = [...body.matchAll(/android:path(?:Prefix|Pattern)?\s*=\s*"([^"]+)"/g)].map((x) => x[1]).join(' ');
+    for (const h of body.matchAll(/android:host\s*=\s*"([^"]+)"/g)) {
+      if (realHost(h[1])) unverified.set(h[1], unverified.get(h[1]) || SENSITIVE_LINK.test(`${h[1]} ${paths}`));
+    }
+  }
+
+  let app = null;
+  try {
+    app = JSON.parse(read(path.join(root, 'app.json')) || 'null');
+  } catch {
+    // not JSON
+  }
+  const expo = (app && (app.expo || app)) || {};
+  for (const s of [].concat(expo.scheme || [])) if (typeof s === 'string') schemes.add(s.toLowerCase());
+  for (const f of ['app.config.js', 'app.config.ts']) {
+    const text = read(path.join(root, f)) || '';
+    for (const m of text.matchAll(/\bscheme\s*:\s*['"`]([\w.+-]+)['"`]/g)) schemes.add(m[1].toLowerCase());
+  }
+  const expoFilters = (expo.android && expo.android.intentFilters) || [];
+  for (const filter of expoFilters.some((f) => f && f.autoVerify) ? [] : expoFilters) {
+    if (!filter || ![].concat(filter.category || []).includes('BROWSABLE')) continue;
+    for (const d of [].concat(filter.data || [])) {
+      if (d && /^https?$/.test(d.scheme || '') && realHost(d.host)) {
+        unverified.set(d.host, unverified.get(d.host) || SENSITIVE_LINK.test(`${d.host} ${d.pathPrefix || ''} ${d.path || ''} ${d.pathPattern || ''}`));
+      }
+    }
+  }
+  let iosDirs = [];
+  try {
+    iosDirs = fs.readdirSync(path.join(root, 'ios'), { withFileTypes: true }).filter((e) => e.isDirectory() && !/^(?:Pods|build)$|Tests$|\.xc/.test(e.name));
+  } catch {
+    // no ios folder
+  }
+  for (const d of iosDirs) {
+    const plist = read(path.join(root, 'ios', d.name, 'Info.plist')) || '';
+    for (const block of plist.match(/<key>CFBundleURLSchemes<\/key>\s*<array>[\s\S]*?<\/array>/g) || []) {
+      for (const s of block.matchAll(/<string>([^<$]+)<\/string>/g)) schemes.add(s[1].toLowerCase());
+    }
+  }
+
+  if (unverified.size) {
+    const hosts = [...unverified.keys()];
+    const sensitive = hosts.filter((h) => unverified.get(h));
+    findings.push({
+      id: 'deeplink-unverified',
+      severity: sensitive.length ? 'medium' : 'low',
+      area: 'security',
+      title: `Web links to ${hosts.slice(0, 2).join(', ')}${hosts.length > 2 ? ` and ${hosts.length - 2} more` : ''} are not verified (no autoVerify)`,
+      detail: `On Android 12+ these links open in the browser instead of the app, and on older Android any installed app that registers the same links can receive them${sensitive.length ? ', including the login/reset/invite links that carry tokens' : ''}. For domains you own, add android:autoVerify="true" to the intent filter and publish /.well-known/assetlinks.json with your signing certificate. (OWASP MASVS-PLATFORM)`,
+      fix: { kind: 'security', step: `Add \`android:autoVerify="true"\` to the https intent filters for ${hosts.slice(0, 3).map((h) => `\`${h}\``).join(', ')} and serve \`https://${hosts[0]}/.well-known/assetlinks.json\`.` },
+    });
+  }
+  const template = [...schemes].filter((s) => TEMPLATE_SCHEMES.has(s));
+  if (template.length) {
+    const oauth = OAUTH_DEPS.filter((d) => deps[d]);
+    findings.push({
+      id: 'deeplink-template-scheme',
+      severity: oauth.length ? 'medium' : 'low',
+      area: 'security',
+      title: `The app still uses the template URL scheme "${template[0]}://"`,
+      detail: `Many other apps kept the same scheme, so ${template[0]}:// links can open a different app${oauth.length ? `, and the sign-in redirect of ${oauth.join(', ')} can be delivered to it` : ''}. Pick a scheme unique to your app (for example your bundle identifier). (OWASP MASVS-PLATFORM)`,
+      fix: { kind: 'security', step: `Replace the "${template[0]}" scheme with one unique to the app (app.json \`scheme\`, AndroidManifest and Info.plist), and update redirect URIs registered with your sign-in providers.` },
+    });
+  }
+  return findings;
+}