Start with a free check of your dependencies against published advisories. Then have senior engineers audit what a scanner cannot see.
Security audits from engineers shipping React Native since 2016.
Start with the free scan. Book the audit if you want us to fix what we find.
Start with the question you need answered. A dependency report, a manual audit, and implementing fixes are different scopes.
Input: a supported npm or Yarn lockfile.
Output: matches between installed package versions and published advisories, with coverage and scan status. This does not assess exploitability in your app.
Read the scanner methodology →Inspect a synthetic scan report →Input: repository access, configuration context, and a technical contact.
Output: a manual audit report with evidence, app-specific priorities, and a remediation plan for the areas agreed in the proposal.
Discuss a manual audit →Input: findings to address and an agreed verification plan.
Output: code changes, validation notes, and remaining risks for the remediation scope. Your team signs off on business workflows and release readiness.
See dependency upgrade delivery →The proposal identifies repositories, platforms, environments, deliverables, and any retesting. Code changes, backend testing, store submission, and ongoing monitoring are included only when explicitly scoped. An audit report supports your security review; it is not a compliance certification.
The public sample above demonstrates the automated dependency report. It is synthetic and does not represent a client engagement or a full manual audit.
Illustrative example with made-up findings. Not from a real client.
Each finding separates the evidence, the advisory's own severity where there is one, and our priority for this particular app. Severity describes a vulnerability in general; priority depends on whether it is reachable and what it exposes.
Evidence: the key is set through react-native-config and appears in plain text in the shipped bundle.
Fix: rotate the key now, then move the calls that need it to the backend and give the app short-lived, per-user tokens. Moving the key into Keychain would not help, because it would still ship with the app.
Evidence: the token is readable in the app's unencrypted Async Storage data on a test device.
Fix: store tokens with Keychain and Keystore-backed storage (react-native-keychain or expo-secure-store) and remove the old entry on upgrade.
minimist 1.2.5 matches GHSA-xvch-5gv4-984h
Advisory: Critical Priority: Low
Evidence: the advisory's affected range is >=1.0.0 <1.2.6. In this app the package is only used by a build script; it is not in the shipped bundle and never parses user input.
Fix: move to 1.2.6 or later through the parent package at the next routine dependency update.
Evidence: 0.68 is outside the officially supported releases. Being unsupported is not a vulnerability by itself; no finding in this audit traces to React Native core. The risk is that future fixes won't be released for this version.
Fix: plan an upgrade to a supported release. It crosses the New Architecture boundary at 0.82, so scope it as a migration.
Evidence: none matches a published advisory, but two block the React Native upgrade.
Fix: replace them or take over maintenance as part of the upgrade plan.
Evidence: traffic is HTTPS-only with App Transport Security and Android's cleartext defaults intact. Pinning is a threat-model decision, and Apple and Android both advise against it in most cases.
No change. If the threat model changes, pin public keys with backup pins and a rotation plan.
Evidence: release builds use the release configuration, and cleartext exceptions exist only in debug configuration.
Run a quick scan, then request a manual audit if needed.
Senior Engineers working with React Native since 2016. North America-based. No outsourcing.
Book a free 30-minute call. We'll discuss your app, your timeline, and what a security audit would cover — no commitment required.
Book a Free Call →After the call we'll send a fixed-price proposal. We'll need code access under NDA and a point of contact who can help validate findings.
Book a free 30-minute call. We'll talk through your app, your compliance timeline, and what a security audit would actually cover — no commitment required.
Our full manual audit covers dependency CVE review, secrets and credential auditing, network security assessment (TLS configuration, cleartext traffic, and whether certificate pinning fits your threat model), local storage and encryption review, build configuration analysis (debug flags, R8/ProGuard settings), deep link and WebView security, and supply chain risk. You receive a detailed report with severity ratings and a prioritized fix plan.
A full manual security audit typically takes 5–10 business days from codebase access to final report delivery, depending on codebase size and complexity.
Yes. We sign NDAs before accessing any code. We request controlled repository access and work in isolated environments. All findings are kept strictly confidential.
The free scanner checks the installed package versions in your lockfile against published npm security advisories. It does not look at your code. The manual audit is conducted by senior engineers who review your entire codebase: dependencies, secrets, network security, storage, build configuration, and native platform specifics. The manual audit catches issues the automated scan cannot.
Yes. We can implement the fixes as part of the engagement, or your team can work from the prioritized plan in the report.
Findings map to OWASP MASVS and the OWASP Mobile Top 10 (2024). Teams often use the report and its remediation record as evidence in SOC 2, ISO 27001, and enterprise security reviews, but the audit is not a compliance certification.
Check your dependencies for free, or have us review what a scanner cannot see.
Check My App →