@onboarding-yak/react-native@0.8.1
Render remotely configured OnboardingYak onboarding flows in React Native apps.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK automatically sends runtime analytics and documents what it reports, but its interface exposes no way to turn analytics off. The data is limited to onboarding usage metadata, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- The component automatically posts flow and screen analytics to the host app's configured base URL when the flow starts and screens change.
- The README discloses the analytics and says answer text and selected answers are not sent; the exposed analytics option labels the environment, with no opt-out shown in the component interface.
- The reported fields are flow and screen IDs, an ephemeral session ID, flow version, environment, platform, and optional experiment variant.
- The package is a remote onboarding renderer, and its requests use the app-provided base URL and publishable key.
Source & flagged code
4 flaggedThe component automatically posts flow and screen analytics to the host app's configured base URL when the flow starts and screens change.
lib/index.jsView on unpkg · L680The component automatically posts flow and screen analytics to the host app's configured base URL when the flow starts and screens change.
lib/index.jsView on unpkg · L610Findings
Affected versions and remediation
This report applies to @onboarding-yak/react-native@0.8.1.
See all versions of @onboarding-yak/react-native for other recorded verdicts.
- Review the evidence and your use of @onboarding-yak/react-native@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.