[BUG] False positive on "Add security headers to WebView source"

[jerone]

Bug Description

It appears that the "Add security headers to WebView source" rule returns a false positive when the webview source is set dynamically via useState.

To Reproduce

For example (pseudo code):

const html = "some html";
export function HtmlWebView() {
  const [source, setSource] = useState<WebViewSource>({ uri: "" });

  useEffect(() => {
    setTimeout(() => {
      setSource({ html });
    }, 0);
  }, [html]);

  return <WebView source={source} />;
}

Expected Behavior

In the example above I would have expected another issue "Add Content-Security-Policy meta tag to HTML", instead of "Add security headers to WebView source".

Actual Behavior

It returns "Add security headers to WebView source" as a LOW issue.

Environment

• rnsec version: 1.1.0
• Node version: v24.11.1
• OS: Windows 11
• React Native: 0.81.5
• Expo version: 54.0.31