brianegan / brianegan/flutter_stetho
Stehto on production is out of my view a huge security risk
- Dominant language
- Dart
- Stars
- 217
- Forks
- 63
- PR merge metrics
- No merged PRs in 30d
Description
I was thinking about to use your lib, but I have a lot of concerns. It seems that is has also just an implementation for Android and there is no replacement for iOS, which is fine so far but there should be a hint that you don't support iOS!
My security concern is, that on production you can see session cookies and might be even API or OAuth tokens, which must be protected. While for debug that is fine since that happens typically just on the developer's devices.
I am not sure if in flutter/dart dependencies can be used only for debug, if that is possible I would suggest that you mention that how to setup it correctly.
My suggestion is just to setup stehto just as a debug dependency in gradle, so that it will be never get on production.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the Flutter/Dart dependency setup and the Android Gradle configuration for Stetho. Check how the library is included in production builds and how Android-only support is communicated. Done means production builds cannot expose Stetho data and the iOS limitation and setup guidance are documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- dart, flutter
- Domain
- mobile-dev, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100