Every rule shipped by @rn-security/auditor. Identifiers are permanent: once published, a rule id
is never reused or renumbered, because it appears in baselines, suppressions and SARIF output (§78).
| ID | Rule | Base severity | Applies to |
|---|---|---|---|
| RNSEC-SECRET-001 | Hardcoded credential | critical | any file |
| RNSEC-STORAGE-001 | Sensitive data in unencrypted storage | high | JS/TS, Kotlin, Java, Swift |
| RNSEC-CRYPTO-001 | Broken or misused cryptographic primitive | high | any file |
| RNSEC-CRYPTO-002 | Predictable randomness for a security value | high | JS/TS, Kotlin, Java |
| RNSEC-NETWORK-001 | Cleartext HTTP endpoint | high | source and configuration |
| RNSEC-NETWORK-002 | TLS validation disabled or weakened | critical | any file |
| RNSEC-WEBVIEW-001 | Unsafe WebView configuration | high | JSX/TSX, Kotlin, Java, Swift |
| RNSEC-DEEPLINK-001 | Deep link handled without validation | high | JS/TS, AndroidManifest.xml |
| RNSEC-LOG-001 | Sensitive data written to a log | medium | any file |
| RNSEC-ANDROID-MANIFEST-001 | Insecure manifest configuration | high | AndroidManifest.xml |
| RNSEC-ANDROID-MANIFEST-002 | Exported component without a permission | medium | AndroidManifest.xml |
| RNSEC-IOS-PLIST-001 | App Transport Security weakened | high | Info.plist |
| RNSEC-DEPS-001 | Unpinned or unauthenticated dependency | medium | package.json |
| RNSEC-RN-001 | Dynamic code execution | high | JS/TS |
| RNSEC-AI-001 | Prompt injection aimed at an AI code reviewer | medium | any file except documentation |
Each page states what the rule detects, why it matters, and — as importantly — the false positives it deliberately avoids. A static analyser is judged on the findings it does not produce as much as on the ones it does, and every rule here has tests for both.
Severity shown above is the rule's base. The engine adjusts it for context: findings in test code drop one level, findings in fixtures drop two, and a configured override wins outright. Every adjustment is recorded on the finding.
Rules carry identifiers only — CWE, MASWE, MASVS, and the MASTG tests that verify a fix. Those identifiers are checked at registration against a snapshot generated from the official OWASP and MITRE sources, so a rule citing something that does not exist fails immediately rather than shipping a report nobody can verify. See the knowledge layer.
Any finding can be suppressed with a reason — never without one. See configuration.