$ show adnxy/rnsec
rnsec is a zero-configuration static analysis security scanner for React Native and Expo applications. It scans JavaScript/TypeScript, XML, plist, and JSON files for over 85 security rules covering storage, network, authentication, cryptography, logging, Android/iOS platform issues, and supply chain risks. The tool uses Babel AST parsing and regex pattern matching to detect hardcoded secrets, insecure configurations, and common vulnerabilities. It generates HTML, JSON, and Markdown reports, supports CI/CD integration with changed-files scanning, and can post results as GitHub PR comments. The architecture is a monolith CLI application built with Commander, with a modular rule engine that registers scanner groups. The codebase is well-structured, TypeScript strict, and includes comprehensive tests for all rules.
The LLM identified 4 files worth highlighting for reuse:
Provides standalone utility functions for string analysis: extracting code snippets, checking for sensitive keywords, identifying likely identifiers vs secrets, calculating entropy, and detecting debug/development context. The `isInDebugContext` function is particularly sophisticated, analyzing file paths, code patterns, and imports to filter out false positives from debug-only code. These functions are self-contained and could be extracted into a separate npm package for use in any static analysis or security tool.
Defines a comprehensive list of API secret patterns (AWS, Firebase, Stripe, GitHub, Slack, etc.) with regex, severity, and descriptions. Also includes sensitive keyword categories and entropy thresholds. This is a reusable asset that could be published as a standalone library for secret scanning in any codebase, independent of the rnsec rule engine.
Implements security metrics calculation: weighted security score (0-100), vulnerability density (issues per 1000 lines), trend comparison between scans, and ASCII trend chart generation. These functions are self-contained and could be reused in any security reporting tool or CI/CD pipeline to quantify security posture changes over time.
A thin wrapper around Babel parser that provides error recovery and returns a consistent ParseResult interface. It configures plugins for JSX, TypeScript, decorators, and dynamic imports. This is a reusable component for any tool that needs to parse JavaScript/TypeScript files with graceful error handling, and could be extracted as a standalone utility.