What RepoSignal Surfaced in React — and Why Review Alone Doesn't Catch Everything
· RepoSignal.io · May 2026 *
The React repository has over 220,000 GitHub stars. It is maintained by Facebook engineers, reviewed by thousands of contributors, and used by millions of developers worldwide. It is one of the most scrutinized open source codebases in existence.
We connected it to RepoSignal.
Within 24 seconds, the scanner returned 20 findings requiring review: 16 high severity and 4 medium severity. Each finding maps to a real code location and a real pattern. Exploitability depends on execution context — that is always true of static analysis output. But every one of these findings points to something a reviewer should examine.
