What are the signs that a React method is truly dead code rather than a method used indirectly?

How to tell dead code from indirect use in React

The clearest signal is absence of reachability, not just absence of an obvious call site. If a method name appears only at its definition and nowhere else in the repository, it is usually dead code. If it is referenced through a prop, callback, ref, lifecycle path, or higher-order wrapper, it may still be in use even when a direct text search looks empty.

Indirect use matters because React code often routes behavior through composition rather than explicit calls. A method can be invoked by a child component, passed down as an event handler, or triggered by a lifecycle hook without ever appearing as a straightforward local call. That means you should treat “no direct reference” as a screening result, not a final verdict.

What you should inspect before removing it

Start by searching the whole codebase for the method name, then inspect every place where the function could be passed rather than called. In React, that includes JSX props, destructured props, callback wiring, memoized values, forwarded refs, and any utility that stores or re-emits the function. A method that seems isolated in one file may still be part of a component contract elsewhere.

Also check whether the method is reached through indirection that a simple text search can miss. For example, a function may be exported, imported under a different name, wrapped in another function, or invoked through an object property. Static search is useful, but the real question is whether any execution path still depends on the method.

When you can trace the method only to its definition and find no runtime path into it, removal is usually safe. In practice, that decision is strongest when the code has tests, the component API has been reviewed, and the method is not part of a public interface or event contract that might be used outside the current repository.

Why false dead-code calls happen

React encourages patterns that hide usage from a naive search. A handler can be passed as a prop and invoked later, a custom hook can return a function that is consumed in another component, and a lifecycle method can be triggered by framework behavior rather than direct code references. Those patterns make “grep says nothing else uses it” an incomplete test.

The main failure mode is deleting a method that is only indirectly referenced. That can break interaction logic, remove an event path, or silently disable behavior that is exercised only in specific UI states. A second common failure is missing use through aliasing, where the function name no longer matches the call site because it was renamed, wrapped, or exported through a different module boundary.

Risk and Threat Considerations

Incorrect dead-code removal is a reliability risk more than a security one, but it can still create production impact if the method was part of a rarely used user flow or an error-handling path. The practical danger is shipping a cleanup change that looks safe in source search but breaks behavior that is only activated indirectly.

Failure mechanism: A text-only search misses references that happen through props, callbacks, refs, wrappers, or framework-driven invocation, so code that still has a live execution path gets removed.

Impact: A UI action, data update, or edge-case recovery path can fail after deployment, and the defect may be hard to trace because the deleted method looked unused in a superficial audit.

Practitioner Guidance

What to verify: Confirm both static and structural usage. Search for imports, props, returned callbacks, refs, and any call chain that could reach the method indirectly before you treat it as dead.

Decision rule: If the only evidence is the function definition and no runtime path exists, removal is reasonable. If the method is part of a component interface, event contract, or exported API, keep it until you have stronger proof that no consumer remains.

Practitioner takeaway: In React, “no direct reference” is a useful clue, but only “no reachable path anywhere” is a solid basis for deletion.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.