secure_code_scanner 1.0.2

Enterprise-grade Flutter/Dart SAST tool with 18 security detectors. Finds hardcoded secrets, insecure storage, SQL injection, missing SSL pinning, Firebase misconfigs, weak JWT handling, WebView flaws [...]

🔒 secure_code_scanner

A professional Static Application Security Testing (SAST) tool for Flutter/Dart projects.

Detect security vulnerabilities in your Dart code before they ship — hardcoded secrets, insecure HTTP connections, unsafe storage, dangerous Android permissions, and more.

---

Features

• 🔍 Recursive project scanning — scans all .dart files, AndroidManifest.xml, pubspec.yaml, build.gradle, and Firebase *.rules
• 🛡️ 15 vulnerability detectors built-in (Enterprise SAST tier):
  1. Hardcoded API Keys: Detects API keys and secrets hardcoded in the source code.
  2. Hardcoded Passwords: Finds raw passwords and secrets stored as strings.
  3. Insecure HTTP Usage: Alerts on using http:// instead of the secure https://.
  4. Sensitive Data Logging: Detects print or log statements that leak sensitive info.
  5. SharedPreferences Insecure Storage: Checks for unsafe local storage usage.
  6. Unsafe File Storage: Monitors for dangerous file storage operations on the device.
  7. Dangerous Android Permissions: Scans AndroidManifest.xml for excessive/dangerous permissions.
  8. Missing Encryption Indicators: Identifies plaintext storage where encryption is needed.
  9. Input Validation Risks: Detects missing validation in TextFields.
  10. Firebase Misconfiguration: Scans Firebase setup for connection and rule vulnerabilities.
  11. SSL / Certificate Pinning Missing: Identifies missing SSL Pinning to prevent MITM attacks.
  12. SQL Injection: Detects weak patterns in local SQLite database queries.
  13. WebView Security Misconfiguration: Alerts on unsafe WebView configurations.
  14. JWT Weak Handling: Detects weak or insecure handling of JSON Web Tokens.
  15. Dependency Vulnerability Scan: Checks pubspec.yaml for known weak packages.
• 📊 Security Score from 0–100 with letter grade (A+ → F)
• 🖥 Colored terminal report with per-vulnerability fix recommendations and secure code examples
• 📄 Plain-text & JSON report export for CI/CD pipeline integration (--output / --json)
• ⚙️ CI/CD ready — exits with code 2 when project is NOT SECURE
• 🧩 Extensible — add custom detectors by extending BaseDetector

---

Getting Started

As a CLI Tool

Add to your pubspec.yaml dev dependencies:

dev_dependencies:
  secure_code_scanner: ^1.0.2

1. First, add the package to your project: Open your terminal inside the root directory of your app and add the package as a development tool:

flutter pub add dev:secure_code_scanner

Then run: 2. Second, run the scan: While you are still in the same project directory, run this simple command:

dart pub get
dart run secure_code_scanner scan

If you are outside the project directory and want to scan a different project, you can pass the folder path using the --path flag like this:

dart run secure_code_scanner scan --path C:\Projects\MyFlutterApp

This accurately triggers the CI/CD pipeline to fail automatically until the security problems are resolved.

To get a plain text report (without terminal colors, making it easily readable in server logs):

dart run secure_code_scanner scan --plain

To list help options and check available flags anytime, use this command:

dart run secure_code_scanner --help

As a Dart Package

import 'package:secure_code_scanner/secure_code_scanner.dart';

void main() async {
  final service = ScanService();
  final report = await service.scan('./my_flutter_project');

  print('Score : ${report.securityScore}/100');
  print('Grade : ${service.gradeForScore(report.securityScore)}');
  print('Status: ${report.projectStatus.label}');
  print('Issues: ${report.totalVulnerabilities}');
}

---

Usage

CLI Commands

# Scan current directory
dart run secure_code_scanner scan

# Scan a specific project path
dart run secure_code_scanner scan --path /path/to/my_flutter_app

# Output plain text (great for CI console logs)
dart run secure_code_scanner scan --plain

# Export report to plain-text file
dart run secure_code_scanner scan --output report.txt

# Export report to JSON format (great for automated dashboards)
dart run secure_code_scanner scan --json report.json

# Show version
dart run secure_code_scanner --version

# Show help
dart run secure_code_scanner --help

Programmatic API

import 'package:secure_code_scanner/secure_code_scanner.dart';

void main() async {
  final service = ScanService();

  // Full scan + colored terminal report
  final report = await service.scanAndPrint('./my_project');

  // Scan + get plain text report as String
  final text = await service.scanToString('./my_project');

  // Scan only — inspect results programmatically
  final report2 = await service.scan('./my_project');

  for (final vuln in report2.vulnerabilities) {
    print('[${vuln.riskLevel.label}] ${vuln.type} @ ${vuln.filePath}:${vuln.lineNumber}');
    print('Fix: ${vuln.recommendation}');
  }

  // Export plain-text report to file
  await service.scanAndExport('./my_project', outputPath: 'report.txt');

  // Export JSON report to file
  await service.scanAndExportJson('./my_project', outputPath: 'report.json');

  // Group issues by file
  report2.byFile.forEach((file, issues) {
    print('$file → ${issues.length} issue(s)');
  });
}

Using Individual Detectors

import 'package:secure_code_scanner/secure_code_scanner.dart';

void main() {
  final detector = ApiKeyDetector();
  final code = '''
    const apiKey = "sk-1234567890abcdef";
  ''';

  final issues = detector.detect('lib/api/service.dart', code);
  for (final issue in issues) {
    print(issue); // [HIGH] Hardcoded API Key @ lib/api/service.dart:2
  }
}

Writing a Custom Detector

import 'package:secure_code_scanner/secure_code_scanner.dart';

class InsecureRandomDetector extends BaseDetector {
  @override
  String get name => 'InsecureRandomDetector';

  static final _pattern = RegExp(r'\bRandom\(\)');

  @override
  List<Vulnerability> detect(String filePath, String content) {
    return scanLines(content, (line) => _pattern.hasMatch(line))
        .map((m) => Vulnerability(
              type: 'Insecure Random Number Generator',
              riskLevel: RiskLevel.medium,
              filePath: filePath,
              lineNumber: m.lineNumber,
              lineContent: m.lineContent,
              description: 'dart:math Random() is not cryptographically secure.',
              whyInsecure: 'Random() is predictable and must not be used for security-sensitive values.',
              recommendation: 'Use dart:math Random.secure() for cryptographic purposes.',
              secureCodeExample: 'final random = Random.secure();',
            ))
        .toList();
  }
}

---

Sample Report Output

╔════════════════════════════════════════════════════════════╗
║        🔒  SECURE CODE SCANNER  —  SAST REPORT  v2.0       ║
║          Flutter / Dart Static Application Security Test    ║
╚════════════════════════════════════════════════════════════╝

📁 Project: /Users/dev/my_flutter_app
📂 Files Scanned: 47
🐛 Vulnerabilities Found: 3
⏱  Scan Duration: 312ms

──────────────────────────────────────────────────────────────

  🛡️  DETECTOR COVERAGE (15 modules active):

  ✓ Hardcoded API Keys          ✓ Missing Encryption
  ✓ Hardcoded Passwords         ✓ Input Validation
  ...

──────────────────────────────────────────────────────────────

  VULNERABILITIES DETECTED:

  1. 💀 [CRITICAL] Hardcoded Password
     ────────────────────────────────────────────────────────
     📁 File: lib/api/auth_service.dart
     📍 Line: 14
     💻 Code: String password = "admin123";
     📋 Issue: A password is hardcoded in source code.
     ⚠  Why Dangerous: Anyone with source access can extract it.
     💡 Fix: Use flutter_secure_storage for credentials.

     ✅ Secure Code Example:
     │ final storage = const FlutterSecureStorage();
     │ await storage.write(key: 'password', value: password);

  ════════════════════════════════════════════════════════════

──────────────────────────────────────────────────────────────

  📊 Security Score:  65 / 100  (C  — Fair)
  [█████████████░░░░░░░]

  🏷  Project Status: MODERATE ⚠️

  📈 Breakdown by Severity:
     💀 CRITICAL   1 issue
     🔴 HIGH       1 issue
     🟠 MEDIUM     1 issue

──────────────────────────────────────────────────────────────
  ⚡ Scan complete. Address all CRITICAL and HIGH issues first.
  🔁 Re-run after fixes:  dart run secure_code_scanner scan
  📄 Export report:       dart run secure_code_scanner scan --output report.txt
──────────────────────────────────────────────────────────────

---

Vulnerability Detectors

Detector	Risk Level	What It Finds
ApiKeyDetector	🔴 HIGH	Hardcoded API keys, access keys
PasswordDetector	💀 CRITICAL	Hardcoded passwords, secrets, tokens
EncryptionDetector	💀 CRITICAL	Plaintext storage of sensitive data
SslPinningDetector	💀 CRITICAL	Missing SSL pinning / badCertificateCallback
SqlInjectionDetector	💀 CRITICAL	SQL injection in raw SQLite queries
DependencyDetector	🔴 HIGH	Known insecure package versions (pubspec)
FirebaseDetector	💀 CRITICAL	Insecure Firebase rules (allow read: true)
JwtDetector	🔴 HIGH	JWT stored insecurely or missing expiry check
WebviewDetector	🔴 HIGH	WebView lacking JS or Navigation constraints
HttpDetector	🔴 HIGH	Insecure http:// URLs usage
InputValidationDetector	🟠 MEDIUM	Missing input validation on text fields

| SensitiveLogDetector | 🟠 MEDIUM | print/debugPrint leaking tokens/passwords | | SharedPrefsDetector | 🔴 HIGH | Sensitive data in SharedPreferences | | FileStorageDetector | 🔴 HIGH | Sensitive data written to local files | | ManifestPermissionDetector | CRITICAL–LOW | Dangerous Android permissions |

---

Security Score

Score	Grade	Status
90–100	A+	Excellent
80–89	A	Secure ✅
70–79	B	Good
60–69	C	Fair
50–59	D	Needs Improvement
30–49	E	Poor ⚠️
0–29	F	Critical Risk ❌

---

CI/CD Integration

The tool exits with code 2 when the project status is NOT SECURE, making it easy to fail pipelines on security issues:

# GitHub Actions example
- name: Security Scan
  run: dart run secure_code_scanner scan --plain
  # Exits 0 = SECURE, 2 = NOT SECURE (fails the pipeline)

---

Project Structure

lib/
├── secure_code_scanner.dart          # Public API entry point
└── src/
    ├── models/
    │   ├── risk_level.dart           # RiskLevel enum (low/medium/high/critical)
    │   ├── vulnerability.dart        # Vulnerability model
    │   └── scan_report.dart          # ScanReport + ProjectStatus
    ├── core/
    │   ├── file_scanner.dart         # Recursive file/config discovery (`ProjectFiles`)
    │   ├── vulnerability_detector.dart # Orchestrates all 15 detectors
    │   ├── report_generator.dart     # Terminal, Text, and JSON report generation
    │   └── risk_calculator.dart      # Score, grade, severity breakdown
    ├── detectors/
    │   ├── base_detector.dart        # Abstract base logic and line scanning
    │   ├── api_key_detector.dart
    │   ├── sql_injection_detector.dart
    │   ├── ssl_pinning_detector.dart
    │   ├── firebase_detector.dart
    │   ├── ...                       # (15 detector modules in total)
    └── services/
        └── scan_service.dart         # High-level scan & export pipeline

bin/
└── secure_code_scanner.dart          # CLI entry point

---

Additional Information

• Issues & feedback: Open an issue on the repository.
• Contributing: New detectors can be added by extending BaseDetector — PRs are welcome.
• Roadmap: AI-powered analysis, PDF reports, VS Code extension, OWASP Top 10 detection.
• License: MIT