flutter_auditor
A command-line security & dependency audit tool for Flutter projects. Point
it at a Flutter project and it scans the Android manifest, iOS Info.plist,
Dart source, and pubspec.yaml/pubspec.lock for common security
misconfigurations and dependency hygiene issues — no project modification,
read-only analysis.
Installation
dart pub global activate flutter_auditor
Or run it from source without installing:
dart run bin/flutter_auditor.dart audit
Usage
Run from the root of the Flutter project you want to audit:
flutter_auditor audit
Options
| Flag | Description |
|---|---|
-v, --verbose |
Show full detail for low-risk and maintenance findings (collapsed by default). |
--fail-on <severity> |
Minimum severity that causes a non-zero exit code: critical, high (default), medium, low, info, or none. |
--html <path> |
Write an HTML report (with charts) to the given path, e.g. --html audit_report.html. |
--open |
Open the generated HTML report in the default browser after writing it. |
Example:
flutter_auditor audit --html audit_report.html --open --fail-on medium
What it checks
Android
android:allowBackupenabled- Cleartext (HTTP) traffic permitted
- Exported activities, services, receivers, and providers
android:debuggableenabled- Manifest permissions (high/medium risk)
- Network Security Configuration (cleartext traffic, trusted user certificates)
- Missing or misconfigured backup rules / data extraction rules
iOS
- App Transport Security exceptions (arbitrary loads, weak minimum TLS version)
UIFileSharingEnabledexposing the Documents directory- Missing, empty, or mismatched usage-description strings (camera, location, etc.)
Cross-platform (Dart source)
- Hardcoded secrets (API keys, tokens, credentials, private keys)
- Insecure network usage (cleartext URLs, disabled certificate validation, WebView SSL bypass)
- Insecure storage (sensitive data in
SharedPreferencesor unencrypted Hive boxes)
Dependencies
- Outdated, discontinued, or unlicensed/restricted-license packages
- An outdated Dart SDK constraint (pre-null-safety)
- Dependencies declared in
pubspec.yamlbut never imported
Exit codes
0 if no issue meets the --fail-on threshold, 1 otherwise. Maintenance
findings (outdated/unused dependencies) never affect the exit code.
License
MIT — see LICENSE.
Libraries
- audits/android/allow_backup_audit
- audits/android/backup_rules_audit
- audits/android/cleartext_traffic_audit
- audits/android/debuggable_audit
- audits/android/exported_components_audit
- audits/android/manifest_permission_audit
- audits/android/network_security_config_audit
- audits/audit_registry
- audits/dependencies/dependency_hygiene_audit
- audits/dependencies/unused_dependency_audit
- audits/ios/app_transport_security_audit
- audits/ios/file_sharing_audit
- audits/ios/usage_description_audit
- audits/network/insecure_network_audit
- audits/secrets/hardcoded_secrets_audit
- audits/storage/insecure_storage_audit
- cli/audit_command
- cli/command_runner
- data/android_permissions
- data/license_policy
- data/locked_dependency
- data/maintenance_audit_ids
- data/network_patterns
- data/pattern_rule
- data/permission_info
- data/permission_risk
- data/secret_pattern
- data/secret_patterns
- data/storage_patterns
- data/unused_dependency_ignore_list
- data/usage_description_rule
- data/usage_description_rules
- engine/audit_engine
- models/audit
- models/audit_result
- models/audit_run_result
- models/project_context
- models/security_issue
- models/severity
- reporter/console_reporter
- reporter/html_reporter
- scanner/project_scanner
- utils/android_manifest_helper
- utils/info_plist_helper
- utils/pub_dev_client
- utils/pub_lock_helper
- utils/pubspec_helper