secure_code_scanner 1.0.2

Enterprise-grade Flutter/Dart SAST tool with 18 security detectors. Finds hardcoded secrets, insecure storage, SQL injection, missing SSL pinning, Firebase misconfigs, weak JWT handling, WebView flaws [...]

1.0.2 — Initial Release (2026-04-02)

Added

Core Infrastructure

• FileScanner — recursive project file discovery with configurable excluded directories
• VulnerabilityDetector — orchestrates all detectors, sorts results by severity
• ReportGenerator — full colored ANSI terminal report + plain-text mode
• RiskCalculator — security score (0–100), letter grade (A+→F), severity breakdown
• ScanService — high-level pipeline: scan(), scanAndPrint(), scanToString()

Vulnerability Detectors

• ApiKeyDetector — detects hardcoded API keys and access keys (HIGH)
• PasswordDetector — detects hardcoded passwords, secrets, tokens (CRITICAL)
• HttpDetector — detects insecure http:// URLs, excludes localhost/127.0.0.1 (HIGH)
• SensitiveLogDetector — detects sensitive data in print/debugPrint/log calls (MEDIUM)
• SharedPrefsDetector — detects sensitive data stored in SharedPreferences (HIGH)
• FileStorageDetector — detects sensitive data written to local files (HIGH)
• ManifestPermissionDetector — detects 17 dangerous Android permissions (CRITICAL→LOW)

Models

• Vulnerability — full model: type, riskLevel, filePath, lineNumber, lineContent, description, whyInsecure, recommendation, secureCodeExample
• ScanReport — aggregated report with score, status, duration, byFile grouping
• RiskLevel — enum with weight, label, and icon per level
• ProjectStatus — SECURE / MODERATE / NOT SECURE

CLI (bin/secure_code_scanner.dart)

• dart run secure_code_scanner scan — scan current directory
• --path <dir> — scan a specific project path
• --plain — plain-text output (for CI/CD piping)
• --version — show version
• --help — show usage
• Exit code 2 when project status is NOT SECURE (CI/CD integration)

Tests

• 59 unit tests across 9 test files
• Coverage: ApiKeyDetector, PasswordDetector, HttpDetector, SensitiveLogDetector, SharedPrefsDetector, FileStorageDetector, ManifestPermissionDetector, RiskCalculator, ScanService