@cubis/foundry 0.3.10

package/Ai Agent Workflow/skills/flutter-security-reviewer/references/vulnerability-patterns.md

@@ -0,0 +1,189 @@
+# Vulnerability Patterns
+
+> Reference for: Security Reviewer
+> Load when: Manual security code review
+
+## SQL/NoSQL Injection
+
+```dart
+// VULNERABLE - String interpolation
+final query = "SELECT * FROM users WHERE id = $userId";
+
+// SECURE - Parameterized queries (Sqflite)
+final result = await db.query(
+  'users',
+  where: 'id = ?',
+  whereArgs: [userId],
+);
+
+// SECURE - ORM (Isar)
+final user = await isar.users.filter().idEqualTo(userId).findFirst();
+```
+
+## Path Traversal
+
+```dart
+// VULNERABLE
+final file = File('$uploadDir/${request.filename}');
+
+// SECURE - Validate and normalize
+final filename = path.basename(request.filename);
+final file = File(path.join(uploadDir, filename));
+
+// Verify path is within allowed directory
+if (!file.path.startsWith(path.canonicalize(uploadDir))) {
+  throw SecurityException('Invalid path');
+}
+```
+
+## Insecure Direct Object Reference (IDOR)
+
+```dart
+// VULNERABLE - No authorization check
+Future<Document> getDocument(String docId) async {
+  return await documentRepository.findById(docId);
+}
+
+// SECURE - Verify ownership
+Future<Document> getDocument(String docId, String userId) async {
+  final doc = await documentRepository.findById(docId);
+  if (doc.ownerId != userId) {
+    throw UnauthorizedException('Access denied');
+  }
+  return doc;
+}
+```
+
+## Sensitive Data Exposure
+
+```dart
+// VULNERABLE - Logging sensitive data
+logger.info('User login: email=$email, password=$password');
+logger.debug('Token: $authToken');
+
+// SECURE - Redact sensitive fields
+logger.info('User login: email=$email');
+logger.debug('Token: [REDACTED]');
+
+// VULNERABLE - Error response exposes internals
+return Response.error(exception.stackTrace.toString());
+
+// SECURE - Generic error
+return Response.error('An error occurred');
+```
+
+## Insecure Storage
+
+```dart
+// VULNERABLE - Plain SharedPreferences for tokens
+final prefs = await SharedPreferences.getInstance();
+await prefs.setString('auth_token', token);
+
+// SECURE - Use flutter_secure_storage
+final storage = FlutterSecureStorage();
+await storage.write(key: 'auth_token', value: token);
+
+// VULNERABLE - Unencrypted Isar for sensitive data
+final isar = await Isar.open([UserSchema]);
+
+// SECURE - Encrypted Isar
+final isar = await Isar.open(
+  [UserSchema],
+  encryptionKey: encryptionKey,
+);
+```
+
+## Authentication Bypass
+
+```dart
+// VULNERABLE - Client-side only check
+if (user.role == 'admin') {
+  showAdminPanel();
+}
+
+// SECURE - Server validates, client just displays
+// Server: verify role in JWT/session before returning admin data
+// Client: display based on server response
+
+// VULNERABLE - Trusting client headers
+final orgId = request.headers['X-Org-Id'];
+
+// SECURE - Derive from authenticated session
+final orgId = authenticatedUser.organizationId;
+```
+
+## Session Management Issues
+
+```dart
+// VULNERABLE - No session timeout
+// Token never expires
+
+// SECURE - Short-lived access tokens + refresh
+final accessToken = jwt.sign(
+  payload,
+  secret,
+  expiresIn: Duration(minutes: 15),
+);
+
+// VULNERABLE - Session not cleared on logout
+Future<void> logout() async {
+  // Just navigate away
+  context.go('/login');
+}
+
+// SECURE - Clear all sensitive data
+Future<void> logout() async {
+  await secureStorage.deleteAll();
+  await isar.writeTxn(() => isar.clear());
+  ref.invalidate(sessionProvider);
+  context.go('/login');
+}
+```
+
+## Deep Link Security
+
+```dart
+// VULNERABLE - No auth check on deep link
+GoRoute(
+  path: '/document/:id',
+  builder: (context, state) => DocumentView(id: state.params['id']!),
+)
+
+// SECURE - Guard protects deep links
+GoRoute(
+  path: '/document/:id',
+  redirect: (context, state) {
+    if (!isAuthenticated) return '/login?redirect=${state.uri}';
+    return null;
+  },
+  builder: (context, state) => DocumentView(id: state.params['id']!),
+)
+```
+
+## Quick Reference
+
+| Vulnerability     | Input Vector    | Prevention                    |
+| ----------------- | --------------- | ----------------------------- |
+| SQL Injection     | Query params    | Parameterized queries         |
+| Path Traversal    | File paths      | path.basename + validation    |
+| IDOR              | Resource IDs    | Authorization checks          |
+| Data Exposure     | Logs, errors    | Redaction, generic errors     |
+| Insecure Storage  | Local storage   | flutter_secure_storage        |
+| Auth Bypass       | Client checks   | Server-side validation        |
+| Session Issues    | Token handling  | Short TTL, proper logout      |
+| Deep Link Bypass  | URL schemes     | Route guards                  |
+
+## OWASP Mobile Top 10 Mapping
+
+| OWASP Mobile              | Vulnerabilities                    |
+| ------------------------- | ---------------------------------- |
+| M1 Improper Platform Use  | Insecure storage, deep link bypass |
+| M2 Insecure Data Storage  | SharedPreferences for tokens       |
+| M3 Insecure Communication | HTTP, no cert pinning              |
+| M4 Insecure Authentication| Weak session, no timeout           |
+| M5 Insufficient Crypto    | Weak encryption, hardcoded keys    |
+| M6 Insecure Authorization | IDOR, client-side checks           |
+| M7 Client Code Quality    | Injection, path traversal          |
+| M8 Code Tampering         | No integrity checks                |
+| M9 Reverse Engineering    | Hardcoded secrets                  |
+| M10 Extraneous Functionality | Debug endpoints, test data      |

package/Ai Agent Workflow/skills/flutter-security-reviewer/steering/log_redaction.md

@@ -0,0 +1,17 @@
+# Logging redaction policy
+
+## Never log
+- Authorization headers
+- Cookies
+- refresh/access tokens
+- passwords/OTP codes
+- full request/response bodies containing PII
+
+## Recommended
+- Log request method + path + status code
+- Log timing and correlation ids
+- Redact sensitive fields:
+
+Example (pseudo):
+- headers: replace Authorization with "***"
+- body: replace keys like token/password with "***"

package/Ai Agent Workflow/skills/flutter-security-reviewer/steering/network_hardening.md

@@ -0,0 +1,13 @@
+# Network hardening (Dio)
+
+Checklist:
+- HTTPS only for UAT/Prod
+- Timeouts configured
+- Interceptors do not leak sensitive info
+- No `badCertificateCallback` in release
+- Use request IDs/transaction hashes for tracing (non-secret)
+
+Retry policy:
+- idempotent requests only (GET)
+- exponential backoff
+- cap attempts

package/Ai Agent Workflow/skills/flutter-security-reviewer/steering/secret-scanning.md

@@ -0,0 +1,123 @@
+# Secret Scanning
+
+> Reference for: Security Reviewer
+> Load when: Scanning for hardcoded secrets
+
+## Manual Grep Patterns
+
+```bash
+# Common secret patterns
+grep -rn "api_key\|apikey\|api-key" --include="*.dart" .
+grep -rn "secret\|password\|passwd" --include="*.dart" .
+grep -rn "private_key\|privatekey" --include="*.dart" .
+grep -rn "access_token\|accesstoken" --include="*.dart" .
+
+# Firebase/Google
+grep -rn "AIza[0-9A-Za-z_-]{35}" .
+grep -rn "firebase" --include="*.dart" .
+
+# AWS credentials
+grep -rn "AKIA[0-9A-Z]{16}" .
+grep -rn "aws_secret_access_key" .
+
+# Base64 encoded (potential secrets)
+grep -rn "[A-Za-z0-9+/]{40,}=" .
+
+# JWT tokens
+grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .
+```
+
+## Common Secret Patterns
+
+| Type              | Pattern                          | Example                    |
+| ----------------- | -------------------------------- | -------------------------- |
+| AWS Access Key    | `AKIA[0-9A-Z]{16}`               | AKIAIOSFODNN7EXAMPLE       |
+| AWS Secret Key    | 40 char base64                   | wJalrXUtnFEMI/K7MDENG...   |
+| Firebase API Key  | `AIza[0-9A-Za-z_-]{35}`          | AIzaSyC...                 |
+| GitHub Token      | `ghp_[A-Za-z0-9]{36}`            | ghp_xxxxxxxxxxxx           |
+| Slack Token       | `xox[baprs]-`                    | xoxb-xxx-xxx               |
+| Stripe Key        | `sk_live_[A-Za-z0-9]{24}`        | sk_live_xxxx               |
+| Private Key       | `-----BEGIN.*PRIVATE KEY-----`  | RSA/EC keys                |
+| JWT               | `eyJ[A-Za-z0-9_-]*\.eyJ`         | Encoded tokens             |
+
+## Flutter-Specific Locations to Check
+
+```bash
+# Check these files for hardcoded secrets
+lib/core/config/
+lib/firebase_options.dart
+android/app/google-services.json
+ios/Runner/GoogleService-Info.plist
+.env files
+pubspec.yaml (sometimes contains keys)
+```
+
+## What to Look For
+
+### Hardcoded API Keys
+```dart
+// BAD - Hardcoded
+const apiKey = 'sk_live_abc123xyz';
+const firebaseKey = 'AIzaSyC...';
+
+// GOOD - Environment variable or secure storage
+final apiKey = const String.fromEnvironment('API_KEY');
+final apiKey = await secureStorage.read(key: 'api_key');
+```
+
+### Hardcoded URLs with Credentials
+```dart
+// BAD
+const dbUrl = 'postgres://user:password@host:5432/db';
+
+// GOOD
+final dbUrl = const String.fromEnvironment('DATABASE_URL');
+```
+
+### Debug/Test Credentials
+```dart
+// BAD - Test credentials in production code
+const testUser = 'admin';
+const testPassword = 'admin123';
+
+// GOOD - Only in test files, never committed
+// Use environment variables or test fixtures
+```
+
+## Remediation Steps
+
+1. **Rotate immediately** - Consider secret compromised
+2. **Remove from code** - Replace with environment variable
+3. **Remove from git history** - Use BFG or git filter-branch
+4. **Add to .gitignore** - Prevent future commits
+5. **Use secure storage** - flutter_secure_storage for runtime secrets
+6. **Use --dart-define** - For build-time configuration
+
+```bash
+# Build with environment variables
+flutter build apk --dart-define=API_KEY=$API_KEY
+
+# Access in code
+const apiKey = String.fromEnvironment('API_KEY');
+```
+
+## Pre-commit Prevention
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.0
+    hooks:
+      - id: gitleaks
+```
+
+## Quick Reference
+
+| Location                    | Risk Level | Action                      |
+| --------------------------- | ---------- | --------------------------- |
+| Source code (.dart)         | Critical   | Remove, use env vars        |
+| Config files                | High       | Move to .gitignore          |
+| Git history                 | Critical   | Rewrite history             |
+| Build artifacts             | Medium     | Ensure not committed        |
+| Comments/TODOs              | Medium     | Remove sensitive info       |

package/Ai Agent Workflow/skills/flutter-security-reviewer/steering/secure_storage_policy.md

@@ -0,0 +1,16 @@
+# Secure storage policy (mobile)
+
+## Token storage
+Preferred:
+- Platform-backed secure storage for auth tokens
+
+If you must use SharedPreferences:
+- access tokens should be short-lived
+- never store refresh token unless encrypted/secured
+- clear all tokens on logout
+- guard against backup/restore exposures where relevant
+
+## Cached user/profile data
+- Apply TTL
+- Avoid caching sensitive PII unless required for offline
+- Clear per-organization/user on logout or org switch

package/Ai Agent Workflow/skills/flutter-security-reviewer/steering/vulnerability-patterns.md

@@ -0,0 +1,189 @@
+# Vulnerability Patterns
+
+> Reference for: Security Reviewer
+> Load when: Manual security code review
+
+## SQL/NoSQL Injection
+
+```dart
+// VULNERABLE - String interpolation
+final query = "SELECT * FROM users WHERE id = $userId";
+
+// SECURE - Parameterized queries (Sqflite)
+final result = await db.query(
+  'users',
+  where: 'id = ?',
+  whereArgs: [userId],
+);
+
+// SECURE - ORM (Isar)
+final user = await isar.users.filter().idEqualTo(userId).findFirst();
+```
+
+## Path Traversal
+
+```dart
+// VULNERABLE
+final file = File('$uploadDir/${request.filename}');
+
+// SECURE - Validate and normalize
+final filename = path.basename(request.filename);
+final file = File(path.join(uploadDir, filename));
+
+// Verify path is within allowed directory
+if (!file.path.startsWith(path.canonicalize(uploadDir))) {
+  throw SecurityException('Invalid path');
+}
+```
+
+## Insecure Direct Object Reference (IDOR)
+
+```dart
+// VULNERABLE - No authorization check
+Future<Document> getDocument(String docId) async {
+  return await documentRepository.findById(docId);
+}
+
+// SECURE - Verify ownership
+Future<Document> getDocument(String docId, String userId) async {
+  final doc = await documentRepository.findById(docId);
+  if (doc.ownerId != userId) {
+    throw UnauthorizedException('Access denied');
+  }
+  return doc;
+}
+```
+
+## Sensitive Data Exposure
+
+```dart
+// VULNERABLE - Logging sensitive data
+logger.info('User login: email=$email, password=$password');
+logger.debug('Token: $authToken');
+
+// SECURE - Redact sensitive fields
+logger.info('User login: email=$email');
+logger.debug('Token: [REDACTED]');
+
+// VULNERABLE - Error response exposes internals
+return Response.error(exception.stackTrace.toString());
+
+// SECURE - Generic error
+return Response.error('An error occurred');
+```
+
+## Insecure Storage
+
+```dart
+// VULNERABLE - Plain SharedPreferences for tokens
+final prefs = await SharedPreferences.getInstance();
+await prefs.setString('auth_token', token);
+
+// SECURE - Use flutter_secure_storage
+final storage = FlutterSecureStorage();
+await storage.write(key: 'auth_token', value: token);
+
+// VULNERABLE - Unencrypted Isar for sensitive data
+final isar = await Isar.open([UserSchema]);
+
+// SECURE - Encrypted Isar
+final isar = await Isar.open(
+  [UserSchema],
+  encryptionKey: encryptionKey,
+);
+```
+
+## Authentication Bypass
+
+```dart
+// VULNERABLE - Client-side only check
+if (user.role == 'admin') {
+  showAdminPanel();
+}
+
+// SECURE - Server validates, client just displays
+// Server: verify role in JWT/session before returning admin data
+// Client: display based on server response
+
+// VULNERABLE - Trusting client headers
+final orgId = request.headers['X-Org-Id'];
+
+// SECURE - Derive from authenticated session
+final orgId = authenticatedUser.organizationId;
+```
+
+## Session Management Issues
+
+```dart
+// VULNERABLE - No session timeout
+// Token never expires
+
+// SECURE - Short-lived access tokens + refresh
+final accessToken = jwt.sign(
+  payload,
+  secret,
+  expiresIn: Duration(minutes: 15),
+);
+
+// VULNERABLE - Session not cleared on logout
+Future<void> logout() async {
+  // Just navigate away
+  context.go('/login');
+}
+
+// SECURE - Clear all sensitive data
+Future<void> logout() async {
+  await secureStorage.deleteAll();
+  await isar.writeTxn(() => isar.clear());
+  ref.invalidate(sessionProvider);
+  context.go('/login');
+}
+```
+
+## Deep Link Security
+
+```dart
+// VULNERABLE - No auth check on deep link
+GoRoute(
+  path: '/document/:id',
+  builder: (context, state) => DocumentView(id: state.params['id']!),
+)
+
+// SECURE - Guard protects deep links
+GoRoute(
+  path: '/document/:id',
+  redirect: (context, state) {
+    if (!isAuthenticated) return '/login?redirect=${state.uri}';
+    return null;
+  },
+  builder: (context, state) => DocumentView(id: state.params['id']!),
+)
+```
+
+## Quick Reference
+
+| Vulnerability     | Input Vector    | Prevention                    |
+| ----------------- | --------------- | ----------------------------- |
+| SQL Injection     | Query params    | Parameterized queries         |
+| Path Traversal    | File paths      | path.basename + validation    |
+| IDOR              | Resource IDs    | Authorization checks          |
+| Data Exposure     | Logs, errors    | Redaction, generic errors     |
+| Insecure Storage  | Local storage   | flutter_secure_storage        |
+| Auth Bypass       | Client checks   | Server-side validation        |
+| Session Issues    | Token handling  | Short TTL, proper logout      |
+| Deep Link Bypass  | URL schemes     | Route guards                  |
+
+## OWASP Mobile Top 10 Mapping
+
+| OWASP Mobile              | Vulnerabilities                    |
+| ------------------------- | ---------------------------------- |
+| M1 Improper Platform Use  | Insecure storage, deep link bypass |
+| M2 Insecure Data Storage  | SharedPreferences for tokens       |
+| M3 Insecure Communication | HTTP, no cert pinning              |
+| M4 Insecure Authentication| Weak session, no timeout           |
+| M5 Insufficient Crypto    | Weak encryption, hardcoded keys    |
+| M6 Insecure Authorization | IDOR, client-side checks           |
+| M7 Client Code Quality    | Injection, path traversal          |
+| M8 Code Tampering         | No integrity checks                |
+| M9 Reverse Engineering    | Hardcoded secrets                  |
+| M10 Extraneous Functionality | Debug endpoints, test data      |

package/Ai Agent Workflow/skills/flutter-security-reviewer/templates/security_review_response.md

@@ -0,0 +1,31 @@
+# Security Review (OneUp HR)
+
+## Threat summary
+- ...
+
+## Findings
+
+### CRITICAL
+- **...**
+  - Risk:
+  - Evidence:
+  - Fix:
+
+### HIGH
+- ...
+
+### MED
+- ...
+
+### LOW
+- ...
+
+## Concrete mitigations
+1) ...
+2) ...
+
+## Security regression checks
+- [ ] ...
+
+## Logging & privacy audit
+- ...