brianegan / brianegan/flutter_stetho

Stehto on production is out of my view a huge security risk

Open
#37 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Dart
Stars
217
Forks
63
PR merge metrics
No merged PRs in 30d

Description

I was thinking about to use your lib, but I have a lot of concerns. It seems that is has also just an implementation for Android and there is no replacement for iOS, which is fine so far but there should be a hint that you don't support iOS!

My security concern is, that on production you can see session cookies and might be even API or OAuth tokens, which must be protected. While for debug that is fine since that happens typically just on the developer's devices.

I am not sure if in flutter/dart dependencies can be used only for debug, if that is possible I would suggest that you mention that how to setup it correctly.

My suggestion is just to setup stehto just as a debug dependency in gradle, so that it will be never get on production.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the Flutter/Dart dependency setup and the Android Gradle configuration for Stetho. Check how the library is included in production builds and how Android-only support is communicated. Done means production builds cannot expose Stetho data and the iOS limitation and setup guidance are documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
dart, flutter
Domain
mobile-dev, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.