nativekeel 0.1.21 → 0.1.22

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.21:** corrected 16 KB page dates: Google Play blocks updates without them from 1 February 2027 (high until then). **0.1.20:** warns about `ImageBackground`, `SafeAreaView`, `DrawerLayoutAndroid` and `UTFSequence`, which React Native has deprecated and will remove (143 of 470 apps we test import one). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.22:** auth tokens in AsyncStorage/MMKV are found by what is stored, not only by the key name. **0.1.21:** corrected 16 KB page dates: Google Play blocks updates without them from 1 February 2027 (high until then). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 470 open-source React Native and Expo apps to keep false alarms out ([what we found in them](https://dev.to/keel_alican_akyol/we-scanned-470-open-source-react-native-apps-here-is-what-breaks-them-5072)). [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/security.js

@@ -569,10 +569,24 @@ export function weakCrypto(root) {
 export function tokenStorage(root) {
   const hits = [];
   for (const file of jsFiles(root)) {
+    // Web-only files (keychain.web.ts) have no Keychain to use; the mobile file decides.
+    if (/\.web\.[cm]?[jt]sx?$/.test(file)) continue;
     const text = read(file);
     if (!text || !/AsyncStorage|MMKV/.test(text)) continue;
+    const at = (i) => `${path.relative(root, file)}:${text.slice(0, i).split('\n').length}`;
+    const seen = new Set();
+    // By key name: setItem('access_token', …)
     for (const m of text.matchAll(/\b(?:AsyncStorage\.setItem|storage\.set|mmkv\.set)\s*\(\s*['"`@]?([\w@.\-:]*?(?:access_?token|refresh_?token|auth_?token|id_?token|jwt|session_?token|bearer)[\w.\-:]*)['"`]?\s*,/gi)) {
-      hits.push(`${m[1]} (${path.relative(root, file)}:${text.slice(0, m.index).split('\n').length})`);
+      seen.add(m.index);
+      hits.push(`${m[1]} (${at(m.index)})`);
+    }
+    // By value: setItem(TOKEN_KEY, token), setItem('user', JSON.stringify({ token })). Push
+    // notification and device tokens are not secrets.
+    for (const m of text.matchAll(/\b(?:AsyncStorage\.setItem|(?:storage|mmkv)\.set(?:String)?)\s*\(\s*([^,()]{1,60}),\s*([^;\n]{0,120})/g)) {
+      if (seen.has(m.index)) continue;
+      if (!/\b(?:access_?token|refresh_?token|auth_?token|id_?token|session_?token|login_?token|accessToken|refreshToken|authToken|idToken|sessionToken|loginToken|jwt|token)\b/i.test(m[2])) continue;
+      if (/push|fcm|apns|expo_?push|notif|device|firebase|messaging/i.test(m[1] + m[2])) continue;
+      hits.push(`${m[1].trim()} (${at(m.index)})`);
     }
   }
   if (!hits.length) return [];