security_doctor 0.2.0

Security audit for Flutter and Dart apps: OWASP MASVS and CWE mapped checks for Dart code, configs and native manifests. Built for CI.

security_doctor

Security audit for Flutter and Dart apps. Every rule maps to an OWASP MASVS requirement and a CWE id, so findings speak the language auditors already use. Built for CI: exit codes work like a test suite, reports come in console, JSON, Markdown and SARIF (GitHub Code Scanning) formats.

Status: pre-release. All phase-1 rules are implemented; first publish is coming as 0.1.0. The sibling package for dependency auditing is pubspec_doctor.

Quick start

dart pub global activate security_doctor
security_doctor

Configuration

Drop a security_audit.yaml next to your pubspec.yaml (all keys optional):

rules:
  SD002: false        # disable a rule
fail_on: high         # exit 1 only for findings at/above this severity
baseline: security_baseline.json  # optional; this is the default name
exclude:
  - lib/generated/**  # globs, relative to the project root

Severities are low, medium, high, critical; the default fail_on is low. The --fail-on CLI flag overrides the config, and --format picks the report: console (default), json, markdown or sarif.

Adopting on an existing project

Snapshot the current findings once, commit the file, and only new findings will fail CI — historical debt stays visible (a "hidden" counter in every report) without blocking:

security_doctor --write-baseline   # writes security_baseline.json

Baseline entries match findings by a content hash (rule + file + normalized line), so they survive unrelated edits and line shifts. Delete the file or re-run --write-baseline to reset.

GitHub Code Scanning

- run: security_doctor --format sarif > security.sarif || true
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: security.sarif

Demo

An intentionally vulnerable mini app lives in example/vulnerable_app — every rule fires on it:

security_doctor --path example/vulnerable_app

Rules (phase 1)

Id	Rule	MASVS	CWE	Status
SD001	Hardcoded secrets and API keys in Dart code	MASVS-STORAGE-1	CWE-798	✅
SD002	Cleartext http:// URLs in code	MASVS-NETWORK-1	CWE-319	✅
SD003	Sensitive data in SharedPreferences	MASVS-STORAGE-1	CWE-922	✅
SD004	Weak cryptography (MD5, SHA1, ECB)	MASVS-CRYPTO-1	CWE-327	✅
SD005	usesCleartextTraffic / NSAllowsArbitraryLoads	MASVS-NETWORK-1	CWE-319	✅
SD006	android:debuggable / android:allowBackup	MASVS-RESILIENCE-2	CWE-489	✅
SD007	Dangerous Android permissions	MASVS-PLATFORM-1	CWE-250	✅
SD008	Sensitive data in print/log output	MASVS-STORAGE-2	CWE-532	✅

Optional compliance mapping (PCI DSS, ISO 27001 Annex A) is planned as an opt-in report layer on top of the same findings.

Exit codes

Code	Meaning
0	No findings at or above the severity threshold.
1	Findings at or above the threshold.
2	Usage or runtime error (e.g. no pubspec.yaml).

License

MIT