Project Audit
One command for project health, delivery impact, and security.
Run a single local command to validate Mach configuration, build profiles, framework and dependency alignment, delivery impact, and security issues. It works without signing in and is suitable for local development or CI.
What It Catches
Project Health
Validates Mach config, profile inheritance, identifiers, Node or Flutter/Dart toolchains, lockfiles, and framework alignment.
Delivery Impact
Classifies changed files as OTA-ready, native rebuild required, store-review sensitive, or needing manual review.
Permission Audit
Flags excessive Android & iOS permissions — including ones silently injected by dependencies.
Secrets Detection
Scans source code for hardcoded API keys, tokens, and passwords (Stripe, AWS, GitHub, Slack, and more).
Dependency CVEs
Checks npm advisories for JavaScript apps and Dart/Flutter dependency advisories and freshness.
Insecure Storage
Detects sensitive data stored in AsyncStorage instead of SecureStore.
HTTP URLs
Finds plain HTTP endpoints in your code that should use HTTPS.
Debug Flags
Catches hardcoded debug modes and console logs that leak sensitive data in production.
Deep Analysis (Post-Prebuild)
Use the `--prebuild` flag for deeper checks that analyze the compiled Android Manifest and iOS Info.plist — catching exported components, disabled App Transport Security, and backup misconfigurations.
CLI Options
--json
Output results as JSON — perfect for CI/CD pipelines.
--fix
Auto-apply safe fixes (e.g., add to blockedPermissions).
--category
Run one check: project, impact, permissions, secrets, dependencies, storage, network, debug, manifest, or ats.
--severity
Filter output by minimum severity: critical, high, medium, low, info.
--prebuild
Run expo prebuild for Android Manifest & iOS plist analysis.
--since
Compare changed files with a Git branch, tag, or commit for OTA/native/store-review guidance.
Examples
Permissions only
mach audit --category permissions
Delivery impact since main
mach audit --category impact --since origin/main
CI pipeline (JSON, fail on critical/high)
mach audit --json --severity high
Deep scan with prebuild
mach audit --prebuild --severity medium
Severity Levels
CRITICAL
Immediate action required — private keys, ATS disabled, debuggable builds
HIGH
Should fix before release — hardcoded secrets, background location, exported components
MEDIUM
Review recommended — camera/mic permissions, HTTP URLs, debug flags
LOW
Informational — photo library access, ATS domain exceptions
The audit exits with code 1 when critical or high issues are found — add it to your CI pipeline to block insecure builds automatically.
