security_doctor #

Security audit for Flutter and Dart apps. Every rule maps to an OWASP MASVS requirement and a CWE id, so findings speak the language auditors already use. Built for CI: exit codes work like a test suite, reports come in console, JSON, Markdown and SARIF (GitHub Code Scanning) formats.

Want the same findings while you type? Add security_doctor_lints and the Dart rules show up right in your IDE, with quick fixes. The sibling package for dependency auditing is pubspec_doctor.

Quick start #

dart pub global activate security_doctor
security_doctor

Configuration #

Drop a security_audit.yaml next to your pubspec.yaml (all keys optional):

rules:
  SD002: false        # disable a rule
fail_on: high         # exit 1 only for findings at/above this severity
baseline: security_baseline.json  # optional; this is the default name
exclude:
  - lib/generated/**  # globs, relative to the project root

Severities are low, medium, high, critical; the default fail_on is low. The --fail-on CLI flag overrides the config, and --format picks the report: console (default), json, markdown or sarif.

Adopting on an existing project #

Snapshot the current findings once, commit the file, and only new findings will fail CI — historical debt stays visible (a "hidden" counter in every report) without blocking:

security_doctor --write-baseline   # writes security_baseline.json

Baseline entries match findings by a content hash (rule + file + normalized line), so they survive unrelated edits and line shifts. Delete the file or re-run --write-baseline to reset.

Suppressing a single finding #

For a deliberate exception, add an inline comment on the finding's line or the line above (any comment syntax — Dart, Gradle or XML):

final devUrl = 'http://intranet.corp/api'; // security_doctor: ignore SD002

<!-- security_doctor: ignore SD006 -->
<application android:allowBackup="true">

Several ids can be comma-separated. Suppressed findings are counted in every report, so exceptions stay visible.

Compliance mapping (PCI DSS, ISO 27001) #

--compliance regroups the report by requirements of a standard, in the language auditors ask in:

security_doctor --compliance pci-dss
security_doctor --compliance iso-27001 --format markdown

Requirements with no findings are listed as clean. The mapping is informative evidence for audit preparation — not a compliance verdict.

GitHub Action #

- uses: actions/checkout@v5
- uses: PopovVA/security_doctor@v0
  with:
    fail-on: high

It also sets exit-code as an output: 0 clean, 1 findings, 2 the run could not start.

GitHub Code Scanning #

Findings land in the Security tab next to the rest of your alerts, each one carrying its MASVS requirement and CWE id:

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v5
  - uses: PopovVA/security_doctor@v0
    with:
      upload-sarif: true

The report is uploaded before the step fails, so an alert still appears on a red build. To collect findings without failing the build, add continue-on-error: true to the step.

Or drive the CLI yourself on any CI system:

- run: security_doctor --format sarif > security.sarif || true
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: security.sarif

Demo #

An intentionally vulnerable mini app lives in example/vulnerable_app — every rule fires on it:

security_doctor --path example/vulnerable_app

Rules #

Exit codes #

Support #

This package is free and maintained in my own time. If it saved you some, buy me a coffee.

License #

MIT