security_doctor library
Security audit for Flutter and Dart apps: OWASP MASVS and CWE mapped checks for Dart code, configs and native manifests.
Classes
- AuditConfig
-
Settings from
security_audit.yamlat the project root. - AuditReport
- The outcome of one audit run.
- Baseline
- A committed snapshot of known findings. Findings matching the baseline are reported as suppressed and never fail the run, so the tool can be adopted on an existing codebase without fixing all historical debt first.
- CleartextConfigRule
-
SD005 — cleartext traffic enabled in native config:
android:usesCleartextTraffic="true"in the Android manifest orNSAllowsArbitraryLoadsin Info.plist. - CleartextHttpRule
-
SD002 — cleartext
http://URLs in Dart code. - ComplianceReporter
- Groups findings by requirement of one standard. Requirements the tool knows but has no findings for are listed as clean, which is the half auditors actually ask for.
- ConsoleReporter
- Human-readable output for terminals.
- DangerousPermissionsRule
- SD007 — dangerous Android permissions declared in the manifest.
- DartRule
- A rule that inspects the parsed AST of a Dart file.
- DebugFlagsRule
-
SD006 — debug/backup flags left on in the release Android manifest:
android:debuggable="true"andandroid:allowBackup="true". - DebuggableEntitlementsRule
-
SD010 —
get-task-allowenabled in iOS/macOS entitlements. - Finding
- One occurrence of a rule violation.
- GradleReleaseConfigRule
- SD009 — release build type without code shrinking.
- HardcodedSecretsRule
- SD001 — hardcoded secrets and API keys in Dart code.
- JsonReporter
- Machine-readable output for CI and tooling.
- MarkdownReporter
- Markdown output for PR comments and job summaries.
- Reporter
- Turns an AuditReport into one of the output formats.
- Rule
- A single security check.
- SarifReporter
- SARIF 2.1.0 output for GitHub Code Scanning and similar tools.
- ScanFile
- One file handed to rules: relative path, contents and classified kind.
- SecurityAuditor
- Runs the enabled rules over a project directory.
- SensitiveLoggingRule
-
SD008 — sensitive data passed to
print/log/debugPrint. - SD003 — sensitive data written to SharedPreferences.
- TextRule
- A rule that inspects the raw text of one file at a time.
- WeakCryptoRule
- SD004 — weak cryptography: MD5, SHA-1, ECB mode.
Enums
- ComplianceStandard
- Compliance standards findings can be grouped by.
- FileKind
- The kinds of files the engine reads. Anything else is skipped without being read from disk.
- Severity
- How serious a finding is.
Constants
-
builtInRules
→ const List<
Rule> - Built-in rules in id order.
-
requirementTitles
→ const Map<
ComplianceStandard, Map< String, String> > - Short titles for every requirement/control referenced by the rule mappings, keyed by standard.
-
ruleMappings
→ const Map<
ComplianceStandard, Map< String, List< >String> > - Rule id → requirements/controls the finding is evidence against.
-
sensitiveWords
→ const Set<
String> - Words that mark an identifier or preference key as sensitive. Matched against whole words split from the name, never substrings — 'authorName' does not contain the word 'auth'.
Functions
-
isSensitiveName(
String name) → bool - Whether an identifier or key is sensitive: any of its words — or any adjacent word pair, so 'apiKey' can match 'apikey' — is in sensitiveWords.
-
run(
List< String> arguments) → Future<int> - Exit codes, matching the pubspec_doctor convention: 0 — no findings at or above the threshold, 1 — findings found, 2 — usage or runtime error.
-
splitIdentifierWords(
String identifier) → List< String> - Splits camelCase, snake_case and kebab-case identifiers into lowercase words.