SonarQube gives code a grade from A to E. I wanted the same thing for the problems that actually stop React Native apps: a store rule you missed, an upgrade that will not build, a crash at launch, a key anyone can pull out of the app.
So NativeKeel, the free CLI I build for React Native and Expo health checks, now rates six areas in every report: Security, Store, Stability, Upgrade, Performance and Accessibility. The rule is SonarQube's: A means nothing found in that area, B only low findings, C medium, D high, E at least one critical.
I graded the 1,040 open-source apps I test it on (scan of 14 October 2026).
| Area | A | B | C | D | E |
|---|---|---|---|---|---|
| Security | 499 | 156 | 154 | 162 | 69 |
| Store | 89 | 4 | 16 | 764 | 167 |
| Stability | 818 | 72 | 74 | 76 | 0 |
| Upgrade | 129 | 148 | 65 | 280 | 418 |
| Performance | 736 | 263 | 41 | 0 | 0 |
| Accessibility | 886 | 41 | 113 | 0 | 0 |
17 apps get an A in every area. 433 have at least one E.
A grade only says what a static scan found. An A is not a guarantee, and some areas can't reach E by design: performance and accessibility findings are never critical.
Store: 931 apps at D or E
The store column is the one that surprised me. Most of it is a date nobody has put in the calendar yet:
- Xcode 27 and UIScene (at least 745 apps). Built with the iOS 27 SDK, an app without the scene life cycle does not launch. App Store uploads need that SDK from April 2027.
- Google Play target SDK (167 apps at E). An app that targets an old API level stops being offered to users on newer Android versions.
- 16 KB memory pages (at least 229 apps), then smaller ones: the iOS privacy manifest, permissions Google Play restricts.
None of these show up while you develop. They show up in a rejection email.
Upgrade: 418 apps at E
E in Upgrade means the New Architecture is still turned off (341 apps), the Expo SDK is no longer supported (237) or React Native itself is past support (168); many apps have more than one. Since 0.82 there is no legacy architecture to fall back to, so every month that passes makes the jump bigger.
Security: 69 apps at E
Two things put most of them there. A dependency version with a critical known vulnerability, most often an old expo package (45 apps), and AWS access keys shipped inside the app (31), which anyone who downloads it can read.
One app or forty
If you look after more than one app, a grade per app is only useful next to the others. fleet scans every React Native and Expo app in a folder (client projects, or a monorepo) and puts them in one table, worst first, with the deadlines each one faces:
npx nativekeel fleet ~/clients --html fleet.html
Keep a run, and next month compare against it:
npx nativekeel fleet ~/clients --json > fleet-2026-10.json
npx nativekeel fleet ~/clients --base fleet-2026-10.json
Every app then shows what moved: "Security E→C, critical 4→2". Here is a sample page for four fictional apps.
A quality gate in pull requests
The GitHub Action keeps one comment on each pull request. It now starts with the gate and shows the grades, with what the change moved:
Quality gate: ✅ passed, no new critical or high findings.
Ratings: Security A (was C) · Store B · Stability A · Upgrade D · Performance A · Accessibility C
Findings the team has accepted go into a .nativekeel.json in the repo, each with a reason. They stay listed in every report, so nothing disappears quietly. Malware warnings can't be ignored that way; the file comes with the repository, and so could the malware.
Try it
npx nativekeel
Free and MIT licensed, no account, and your code stays on your machine. More for teams: nativekeel.com/teams. If you look after many apps, I'd like to hear what your team would need next.
Top comments (0)