posthog-analytics — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited posthog-analytics (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The bootstrap includes a complete PostHog setup with:
ScreenTracker componentusePostHog() hook| File | Purpose |
|---|---|
lib/posthog.ts | Configuration with session replay plugin |
app/_layout.tsx | PostHogProvider wrapper and ScreenTracker component |
app.json | PostHog plugin registration |
.env.example | Environment variable template |
captureNetworkTelemetry: true)captureLog: true)****throttleDelayMs: 1000)All settings are in lib/posthog.ts:
| Setting | Default | Purpose |
|---|---|---|
maskAllTextInputs | true | Hide all text input content |
maskAllImages | true | Blur/hide all images |
captureLog | true | Include console logs in replay |
captureNetworkTelemetry | true | Track API calls |
throttleDelayMs | 1000 | Snapshot interval (milliseconds) |
captureNativeAppLifecycleEvents | true | Track app open/close/background |
Import the hook and use it anywhere:
import { usePostHog } from 'posthog-react-native';
const posthog = usePostHog();
// Track an event
posthog?.capture('button_pressed', {
button_name: 'checkout',
screen: 'product_detail',
});Set user identity (typically after login):
posthog?.identify(userId, {
email: user.email,
plan: 'premium',
});Clear user identity:
posthog?.reset();Update user metadata:
posthog?.setPersonProperties({
credits: 100,
subscription_status: 'active',
});Required for PostHog to work:
EXPO_PUBLIC_POSTHOG_KEY=phc_your_project_key
EXPO_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.comIf not set, PostHog is automatically disabled with a console warning.
PostHog session replay uses native modules. After configuration changes to app.json, you must rebuild:
npx expo prebuild --clean
npx expo run:ios # or run:androidOr with EAS:
eas build --profile development-client --platform ios$screen - Automatic screen views$pageview - Navigation trackingCause: App hasn't been rebuilt after configuration changes Fix: Run npx expo prebuild --clean and rebuild the app
Cause: Session replay requires native modules to be rebuilt Fix: Clean rebuild with npx expo prebuild --clean
Cause: PostHog API key not set or app not rebuilt Fix:
EXPO_PUBLIC_POSTHOG_KEY is set in environmentCause: Default settings mask all inputs and images Fix: Adjust maskAllTextInputs and maskAllImages in lib/posthog.ts if you need to see more data (consider privacy implications)
The ScreenTracker component in app/_layout.tsx automatically tracks all screen views using Expo Router's navigation hooks. No manual tracking needed for navigation.
maskAllTextInputs: true for production~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.