[CI] (6b2dc8b) react-native/react-native-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 6b2dc8b
App: react-native/react-native-saas
App directory: apps/react-native/react-native-saas
Workbench branch: wizard-ci-6b2dc8b-react-native-react-native-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-01T15:57:02.824Z
Duration: 442.6s

YARA Scanner

✓ 197 tool calls scanned, 1 violation detected

  [WARNED] prompt_injection_posthog_integration_attack (MEDIUM) — skill-install:installSkillById

No violations: ✓ 196 clean scans

⚠️ YARA violations detected — see report above

[wizard-ci-bot]

Now I have all the context needed. Let me produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a React Native SaaS app using the posthog-react-native SDK. It adds initialization via environment variables, wraps the app with PostHogProvider and PostHogErrorBoundary, implements manual screen tracking via React Navigation's onStateChange, and adds meaningful event captures across auth, member, project, and team sagas.

Files changed	Lines added	Lines removed
10	+112	-8

Confidence score: 5/5 🧙

• **Incorrect wrapping in identify calls**: The `identify()` call passes `{ : { email } }` as the second argument, but `posthog-react-native`'s `identify(distinctId, userProperties)` already treats the second argument as properties internally. This nests inside, meaning the email person property won't be set correctly. Should be posthog?.identify(email, { email }). [MEDIUM]
• Email used as distinct_id: The code uses the raw email address as the distinct ID. While the API response only returns a token (no user ID), using email as distinct_id is an acceptable fallback per PostHog docs, though not ideal. [LOW]

---

File changes

Filename	Score	Description
src/config/posthog.js	5/5	Clean PostHog initialization with env var validation, dev-mode warnings, and graceful null handling
src/routes.js	5/5	Adds PostHogProvider, PostHogErrorBoundary, and manual screen tracking via onStateChange
src/store/modules/auth/sagas.js	3/5	Adds identify and capture calls but uses incorrect `` wrapping pattern
src/store/modules/members/sagas.js	5/5	Captures member_roles_updated and member_invited with contextual properties
src/store/modules/projects/sagas.js	5/5	Captures project_created with creation_method property
src/store/modules/teams/sagas.js	5/5	Captures team_created and team_selected events
package.json	5/5	Correctly adds posthog-react-native, react-native-config, and react-native-svg (peer dep)
android/app/build.gradle	5/5	Adds dotenv.gradle for react-native-config support
.env.example	5/5	Documents required PostHog env vars
.gitignore	5/5	Adds .env to gitignore

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	Dependencies are correct, build.gradle properly configured for react-native-config
Preserves existing env vars & configs	Yes	Existing navigation and saga logic preserved; PostHog wrapping is conditional on config
No syntax or type errors	Yes	All JavaScript is syntactically valid
Correct imports/exports	Yes	All imports from correct packages (posthog-react-native, react-native-config)
Minimal, focused changes	Yes	All changes directly serve PostHog integration
Pre-existing issues	None	—

Issues

No issues.

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — react-native-config dotenv.gradle correctly applied
• .env added to .gitignore to prevent secret leakage
• Graceful degradation when PostHog is not configured (null checks throughout)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-react-native@^4.66.3 added with peer deps (react-native-svg)
PostHog client initialized	Yes	Correctly uses new PostHog(token, { host, captureAppLifecycleEvents: true })
capture()	Yes	9 meaningful capture calls across auth, members, projects, and teams sagas
identify()	No	Uses email as distinct_id (acceptable fallback) but incorrectly wraps properties with ``
Error tracking	Yes	PostHogErrorBoundary wraps the navigation stack with a fallback component
Reverse proxy	N/A	Mobile app — reverse proxy only applies to browser-based posthog-js

Issues

• **Incorrect wrapping in identify**: The `identify()` calls pass `{ : { email } }` as userProperties. The `posthog-react-native` SDK's `identify(distinctId, userProperties)` already wraps the second argument as internally. This double-nesting means the email won't be set as a person property — instead, a property literally named `` will be created with { email: "..." } as its value. Fix: change to `posthog?.identify(email, { email })`. [MEDIUM]

Other completed criteria

• API key loaded from environment variable via react-native-config
• API host correctly configured from environment variable
• Screen views tracked manually via NavigationContainer's onStateChange with posthog?.screen()
• Both iOS and Android targets covered by single posthog-react-native initialization
• posthog?.reset() called on sign-out
• Dev-mode console errors when env vars are missing

---

PostHog insights and events ✅

Filename	PostHog events	Description
src/routes.js	screen(), captureException (via boundary)	Tracks screen navigation changes and captures uncaught exceptions
src/store/modules/auth/sagas.js	user_signed_in, user_signed_out	Tracks authentication lifecycle with authentication_method property
src/store/modules/members/sagas.js	member_roles_updated, member_invited	Tracks member management with update_method/invitation_method properties
src/store/modules/projects/sagas.js	project_created	Tracks project creation with creation_method property
src/store/modules/teams/sagas.js	team_created, team_selected	Tracks team management actions

Issues

No issues.

Other completed criteria

• Events represent real user actions (sign in, create project, invite member, select team)
• Events enable product insights — can build sign-in → project creation → member invitation funnels
• Events include contextual properties (authentication_method, creation_method, etc.)
• No PII in capture properties — email only used in identify calls (person properties)
• Event names follow consistent snake_case naming convention

---

Reviewed by wizard workbench PR evaluator