OpenAI Codex security directory

Expo

Published by Expo Team

High risk

Provides Expo-authored workflows for building and maintaining Expo and React Native apps. Develop interfaces, native modules, API routes, styling and data-fetching behavior. Debug and upgrade projects, then prepare EAS builds and app-store or web deployments.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Production web/API deploys and App Store / Play Store submissions: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
  • Destructive local cleanup and native project regeneration: Can delete records, files, projects, messages, or resources that may be difficult to recover.
  • Writes project files, run scripts and Codex environment actions: Can read, create, or change files on the local filesystem or in a selected project.
  • Generic cached URL fetcher script: Can send prompts, files, queries, or connected-service data to an external service.
  • Manages signing credentials and creates production secrets: Can create or change persistent records, files, projects, permissions, settings, or credentials.
  • Runs shell commands, npx packages and bundled Node scripts: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • Cloud EAS builds consume paid build credits: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.

Available capabilities

This add-on exposes 13 tools or capabilities.

  • building-native-ui
  • codex-expo-run-actions
  • expo-api-routes
  • expo-cicd-workflows
  • expo-deployment
  • expo-dev-client
  • expo-module
  • expo-tailwind-setup
  • expo-ui-jetpack-compose
  • expo-ui-swift-ui
  • native-data-fetching
  • upgrading-expo
  • use-dom

The interactive security report will load automatically.