Skip to content

FlutterGuard v0.1.0

Choose a tag to compare

View all tags
@anasfik anasfik released this 28 Oct 23:00
· 30 commits to main since this release
v0.1.0
64d940e

First public build of FlutterGuard as an Android app — the agent skill stays in skill/.

What it does

Audits any Flutter app installed on the same device, straight from the OS-exposed APK. No root, no network, no INTERNET permission.

  • Artifact — package, version, SDK range, size, splits, ABIs, hashes, every native lib
  • Flutter specifics — AOT vs JIT kernel, engine/Dart version, obfuscation, Dart dependency inventory (from NOTICES.Z and kernel_blob.bin)
  • Manifest risk — permissions, exported components, cleartext, backup, deep links (aggregated per scheme)
  • Secrets — 20-rule corpus over dex, resources, assets, libapp.so and the Dart kernel; dotenv files get their own parser and CRITICAL when they are prod-named
  • Endpoints — hosts classified first-party / staging / internal / SaaS / IP, plus recovered API routes and Dart source paths
  • Native surface — flutter_rust_bridge, JNI entry points, embedded X.509 identities, TLS bypass markers, proxy schemes

Verified against 12 real apps

Corpus and per-app methodology in CORPUS.md and docs/METHODOLOGY.md, every rule traced back to a manual observation:

App Grade Notable
Kooul F .env.prod with 13 live credentials — CRITICAL
Cake Wallet D 9 endpoint-list YAMLs, embedded X.509, 123 JNI symbols
FluffyChat F ISRG Root X1/X2 reassembled from split PEM lines
Immich D R8-flattened network security config decoded
RustDesk C clean baseline, flutter_rust_bridge surfaced
Spotube, AppFlowy, Bztamy, LocalSend, Hiddify, Obtainium, Primal — false-positive and negative-control calibration

Also this release

  • Version diffs — every scan writes a snapshot, so re-scanning an updated app shows what actually changed (hosts, routes, findings, dependencies)
  • Batch mode — adb shell am start -n com.flutterguard.app/.MainActivity -e scan <package> writes JSON to app-specific external storage, pullable with adb pull
  • Reports are plain JSON + Markdown, shareable from the app

Install

Download app-release.apk below and install it (Android 8.0+). Reports go to Android/data/com.flutterguard.app/files/reports/.

Authorized testing only — audit apps you own or have permission to assess.

Assets 3
Loading