@onboarding-yak/react-native@0.6.1
Render remotely configured OnboardingYak onboarding flows in React Native apps.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK sends runtime analytics automatically and offers environment labels, but no opt-out was found. The documented analytics purpose and limited event metadata make this a warning-level telemetry concern, not malicious behavior.
Decision evidence
public snapshot- When the Onboarding component is used, it posts flow, screen, session, version, and environment metadata to the configured base URL's /api/events endpoint.
- After the flow loads, the component automatically records flow_started and screen_viewed events.
- The README describes analytics and environment labels, but the source and documentation expose no setting to disable event reporting.
- The manifest has no install, preinstall, or postinstall hook; its only lifecycle script is prepublishOnly, which runs the build.
- The analytics payload contains event metadata and a generated session ID, not answers, credentials, or machine details.
- The README describes analytics as part of the package's purpose and explains the publishable key's use for sending analytics events.
Source & flagged code
3 flaggedWhen the Onboarding component is used, it posts flow, screen, session, version, and environment metadata to the configured base URL's /api/events endpoint.
lib/index.jsView on unpkg · L569After the flow loads, the component automatically records flow_started and screen_viewed events.
lib/index.jsView on unpkg · L631Findings
Affected versions and remediation
This report applies to @onboarding-yak/react-native@0.6.1.
See all versions of @onboarding-yak/react-native for other recorded verdicts.
- Review the evidence and your use of @onboarding-yak/react-native@0.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.