A desktop debugging platform for mobile developers.
Installations
npm install react-native-flipperDeveloper
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
Typescript Support
Yes
Node Version
NPM Version
Statistics
13,369 Stars
9,981 Commits
954 Forks
165 Watching
799 Branches
356 Contributors
Updated on 27 Nov 2024
Languages
TypeScript (60.26%)
Java (10.02%)
Objective-C (7.48%)
Kotlin (6.81%)
C++ (5.2%)
Objective-C++ (4.32%)
JavaScript (1.72%)
Ruby (0.96%)
CSS (0.94%)
MDX (0.57%)
Rust (0.36%)
Haskell (0.3%)
Shell (0.29%)
Swift (0.29%)
HTML (0.19%)
Less (0.15%)
CMake (0.08%)
Starlark (0.04%)
C (0.02%)
Total Downloads
Cumulative downloads
Total Downloads
37,028,601
Last day
-3.3%
49,609
Compared to previous day
Last week
-3.5%
251,984
Compared to previous week
Last month
7.7%
1,128,365
Compared to previous month
Last year
14.7%
12,473,272
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Peer Dependencies
2
Dev Dependencies
4
Versions
Flipper
Important Announcement
Flipper is moving away from its Electron distribution to an in-Browser experience.
How does this affect me?
Functionality hasn't changed. The UI remains unchanged. Flipper will run in your default browser instead of a standalone application. If you build from source, Flipper will open in the browser instead of a standalone app. We also provide a MacOS app for the Flipper runtime which can be run and will also open Flipper in the browser.
The last Electron release is v0.239.0. As such, future releases will not include Electron artifacts.
React Native support
If you are debugging React Native applications, v0.239.0 will be the last release with support for it due to technical limitations for React Dev Tools and Hermes Debugger plugins. As such, please refer to that release when debugging React Native applications.
New, dedicated debug tooling for React Native is currently being developed at Meta. In the mean time we recommend this blog post with guidance on how to get the capibilities of Flipper through several alternatives.
Flipper is a platform for debugging mobile apps on iOS and Android and JS apps in your browser or in Node.js. Visualize, inspect, and control your apps from a simple desktop interface. Use Flipper as is or extend it using the plugin API.
Table of Contents
Mobile development
Flipper aims to be your number one companion for mobile app development on iOS and Android. Therefore, we provide a bunch of useful tools, including a log viewer, interactive layout inspector, and network inspector.
Extending Flipper
Flipper is built as a platform. In addition to using the tools already included, you can create your own plugins to visualize and debug data from your mobile apps. Flipper takes care of sending data back and forth, calling functions, and listening for events on the mobile app.
Contributing to Flipper
Both Flipper's desktop app, native mobile SDKs, JS SDKs are open-source and MIT licensed. This enables you to see and understand how we are building plugins, and of course, join the community and help to improve Flipper. We are excited to see what you will build on this platform.
In this repo
This repository includes all parts of Flipper. This includes:
- Flipper's desktop app built using Electron
(
/desktop) - native Flipper SDKs for iOS (
/iOS) - native Flipper SDKs for Android (
/android) - cross-platform C++ SDK (
/xplat) - React Native Flipper SDK (
/react-native) - JS Flipper SDK (
/js) - Plugins (
/desktop/plugins/public/) - website and documentation (
/website,/docs)
Getting started
Please refer to our
Getting Started guide to set up
Flipper. Or, run npx flipper-server for a browser based
version of Flipper.
Requirements
- node >= 18
- yarn >= 1.16
- iOS developer tools (for developing iOS plugins)
- Android SDK and adb
Building from Source
Desktop
Running from source
1git clone https://github.com/facebook/flipper.git 2cd flipper/desktop 3yarn 4yarn start
Building standalone application
Provide either --mac, --win, --linux or any combination of them to
yarn build to build a release zip file for the given platform(s). E.g.
1yarn build --mac
You can find the resulting artifact in the dist/ folder.
iOS SDK + Sample App
1cd iOS/Sample 2rm -f Podfile.lock 3pod install --repo-update 4open Sample.xcworkspace 5<Run app from xcode>
You can omit --repo-update to speed up the installation, but watch out as you
may be building against outdated dependencies.
Android SDK + Sample app
Start up an android emulator and run the following in the project root:
1./gradlew :sample:installDebug
React Native SDK + Sample app
Requires RN 0.69+!
1cd react-native/ReactNativeFlipperExample 2yarn 3yarn android
Note that the first 2 steps need to be done only once.
Alternatively, the app can be started on iOS by running yarn ios.
If this is the first time running, you will also need to run
pod install --repo-update from the
react-native/ReactNativeFlipperExample/ios folder.
React Native Windows (Experimental)
An experimental version of Flipper for React Native Windows is available. The following steps prepare the React Native Flipper project:
1cd react-native/react-native-flipper 2vcpkg install openssl:x64-uwp openssl:arm-uwp 3vcpkg integrate install 4yarn install 5cd windows 6nuget install ReactNativeFlipper/packages.config
In a nutshell, vcpkg is used to install OpenSSL. Nuget is used to install Boost.
Then, the sample application can be built and run as follows:
1cd ../../ReactNativeFlipperExample 2yarn install 3yarn relative-deps 4npx react-native run-windows
At the moment there's no available package for React Native Flipper. This means that to integrate Flipper with any other existing applications, an explicit reference to the project needs to be added just as is done with the sample application.
JS SDK + Sample React app
1cd js/react-flipper-example 2yarn 3yarn start
Troubleshooting
Older yarn versions might show an error / hang with the message 'Waiting for the
other yarn instance to finish'. If that happens, run the command yarn first
separately in the directory react-native/react-native-flipper.
Documentation
Find the full documentation for this project at fbflipper.com.
Our documentation is built with Docusaurus. You can build it locally by running this:
1cd website 2yarn 3yarn start
Contributing
See the CONTRIBUTING file for how to help out.
License
Flipper is MIT licensed, as found in the LICENSE file.
No vulnerabilities found.
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-android.yml:14
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/facebook/.github/SECURITY.md:1
- Info: Found linked content: github.com/facebook/.github/SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: github.com/facebook/.github/SECURITY.md:1
Reason
project is archived
Details
- Warn: Repository is archived.
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/issues.yml:13
- Warn: no topLevel permission defined: .github/workflows/android-sample.yml:1
- Warn: no topLevel permission defined: .github/workflows/build-and-deploy.yml:1
- Warn: no topLevel permission defined: .github/workflows/docs.yml:1
- Warn: no topLevel permission defined: .github/workflows/gradle-wrapper-validation.yml:1
- Warn: no topLevel permission defined: .github/workflows/iOS-Sample.yml:1
- Warn: no topLevel permission defined: .github/workflows/iOS-dependent-pod-lint.yml:1
- Warn: no topLevel permission defined: .github/workflows/iOS-pod-lint.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issues.yml:8
- Warn: no topLevel permission defined: .github/workflows/js.yml:1
- Warn: no topLevel permission defined: .github/workflows/nodejs-pkg.yml:1
- Warn: no topLevel permission defined: .github/workflows/nodejs.yml:1
- Warn: no topLevel permission defined: .github/workflows/packer.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-android.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-npm.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-pods.yml:1
- Warn: no topLevel permission defined: .github/workflows/react-native-example.yml:1
- Warn: no topLevel permission defined: .github/workflows/release.yml:1
- Info: no jobLevel write permissions found
Reason
no SAST tool detected
Details
- Warn: no pull requests merged into dev branch
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v0.273.0 not signed: https://api.github.com/repos/facebook/flipper/releases/186669897
- Warn: release artifact v0.272.0 not signed: https://api.github.com/repos/facebook/flipper/releases/183962958
- Warn: release artifact v0.271.0 not signed: https://api.github.com/repos/facebook/flipper/releases/182656994
- Warn: release artifact v0.270.0 not signed: https://api.github.com/repos/facebook/flipper/releases/180642307
- Warn: release artifact v0.269.0 not signed: https://api.github.com/repos/facebook/flipper/releases/179097123
- Warn: release artifact v0.273.0 does not have provenance: https://api.github.com/repos/facebook/flipper/releases/186669897
- Warn: release artifact v0.272.0 does not have provenance: https://api.github.com/repos/facebook/flipper/releases/183962958
- Warn: release artifact v0.271.0 does not have provenance: https://api.github.com/repos/facebook/flipper/releases/182656994
- Warn: release artifact v0.270.0 does not have provenance: https://api.github.com/repos/facebook/flipper/releases/180642307
- Warn: release artifact v0.269.0 does not have provenance: https://api.github.com/repos/facebook/flipper/releases/179097123
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/android-sample.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/android-sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/android-sample.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/android-sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/android-sample.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/android-sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/android-sample.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/android-sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-deploy.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/build-and-deploy.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-deploy.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/build-and-deploy.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/docs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/docs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/gradle-wrapper-validation.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/gradle-wrapper-validation.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/gradle-wrapper-validation.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/gradle-wrapper-validation.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-Sample.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-Sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-Sample.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-Sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-Sample.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-Sample.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-dependent-pod-lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-dependent-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-dependent-pod-lint.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-dependent-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:140: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:144: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:127: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:153: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:222: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:166: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:179: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:183: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:196: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:205: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/iOS-pod-lint.yml:209: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/iOS-pod-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/issues.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/issues.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issues.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/issues.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/js.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/js.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/js.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-pkg.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs-pkg.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-pkg.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs-pkg.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/nodejs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/packer.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/packer.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/packer.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/packer.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-android.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-android.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-android.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-android.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-android.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-android.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-android.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-android.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-android.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-android.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-npm.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-npm.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-npm.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-npm.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-pods.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-pods.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-pods.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-pods.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-pods.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-pods.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-pods.yml:127: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/publish-pods.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/react-native-example.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/react-native-example.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:108: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:142: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:148: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:154: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:193: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:199: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/facebook/flipper/release.yml/main?enable=pin
- Warn: downloadThenRun not pinned by hash: scripts/install-retry.sh:16
- Info: 0 out of 74 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 41 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 downloadThenRun dependencies pinned
Reason
binaries present in source code
Details
- Warn: binary detected: desktop/static/PortForwardingMacApp.app/Contents/Frameworks/CocoaAsyncSocketMac.framework/Versions/A/CocoaAsyncSocketMac:1
- Warn: binary detected: desktop/static/PortForwardingMacApp.app/Contents/Frameworks/FBPortForwarding-Mac.framework/Versions/A/FBPortForwarding-Mac:1
- Warn: binary detected: desktop/static/PortForwardingMacApp.app/Contents/Frameworks/peertalkMac.framework/Versions/A/peertalkMac:1
- Warn: binary detected: desktop/static/PortForwardingMacApp.app/Contents/MacOS/PortForwardingMacApp:1
- Warn: binary detected: desktop/static/native-modules/keytar-darwin-arm64.node:1
- Warn: binary detected: desktop/static/native-modules/keytar-darwin-x64.node:1
- Warn: binary detected: desktop/static/native-modules/keytar-linux-x64.node:1
- Warn: binary detected: desktop/static/native-modules/keytar-win32-x64.node:1
- Warn: binary detected: scripts/bump.lnx64:1
- Warn: binary detected: scripts/bump.mac:1
- Warn: binary detected: scripts/stricter.lnx64:1
Reason
91 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq
- Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488
- Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-qrpm-p2h7-hrv2
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-566m-qj78-rww5
- Warn: Project is vulnerable to: GHSA-hwj9-h5mp-3pm3
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-36jr-mh4h-2g58
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-c429-5p7v-vgjp
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-g954-5hwp-pp24
- Warn: Project is vulnerable to: GHSA-h755-8qp9-cq85
- Warn: Project is vulnerable to: GHSA-4w2v-q235-vp99
- Warn: Project is vulnerable to: GHSA-cph5-m8f7-6c5x
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-7gc6-qh9x-w6h8
- Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
- Warn: Project is vulnerable to: GHSA-r7qp-cfhv-p84w
- Warn: Project is vulnerable to: GHSA-q9mw-68c2-j6m5
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-3q56-9cc2-46j4
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-74fj-2j2h-c42q
- Warn: Project is vulnerable to: GHSA-pw2r-vq6v-hr8c
- Warn: Project is vulnerable to: GHSA-8hfj-j24r-96c4
- Warn: Project is vulnerable to: GHSA-wc69-rhjr-hc9g
- Warn: Project is vulnerable to: GHSA-w7rc-rwvf-8q5r
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-qm95-pgcg-qqfq
- Warn: Project is vulnerable to: GHSA-cqmj-92xf-r6r9
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-hpx4-r86g-5jrg
- Warn: Project is vulnerable to: GHSA-prr3-c3m5-p7q2
- Warn: Project is vulnerable to: GHSA-phwq-j96m-2c2q
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-hc6q-2mpp-qw7j
- Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
- Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: RUSTSEC-2021-0145 / GHSA-g98v-hv3f-hcfr
- Warn: Project is vulnerable to: RUSTSEC-2024-0375
- Warn: Project is vulnerable to: RUSTSEC-2024-0384
- Warn: Project is vulnerable to: RUSTSEC-2024-0370
- Warn: Project is vulnerable to: GHSA-c2jc-4fpr-4vhg
- Warn: Project is vulnerable to: GHSA-crh6-fp67-6883
- Warn: Project is vulnerable to: GHSA-4cpg-3vgw-4877
- Warn: Project is vulnerable to: GHSA-rxrc-rgv4-jpvx
- Warn: Project is vulnerable to: GHSA-g4rg-993r-mgx7
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
- Warn: Project is vulnerable to: GHSA-hqq7-2q2v-82xq
- Warn: Project is vulnerable to: GHSA-q8gg-vj6m-hgmj
- Warn: Project is vulnerable to: GHSA-jrvm-mcxc-mf6m
- Warn: Project is vulnerable to: GHSA-p3vf-v8qc-cwcr
- Warn: Project is vulnerable to: GHSA-gx9m-whjm-85jf
- Warn: Project is vulnerable to: GHSA-mmhx-hmjr-r674
- Warn: Project is vulnerable to: MAL-2022-3075
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-x3vm-38hw-55wf
- Warn: Project is vulnerable to: GHSA-m4gq-x24j-jpmf
Score
3.5
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More