@cubis/foundry 0.3.10

package/Ai Agent Workflow/powers/flutter-security-reviewer/SKILL.md

@@ -0,0 +1,204 @@
+---
+name: "flutter-security-reviewer"
+displayName: "Flutter/Dart Security Reviewer"
+description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
+keywords:
+  [
+    "security",
+    "flutter security",
+    "dart security",
+    "secure storage",
+    "encryption",
+    "log redaction",
+    "network security",
+    "data protection",
+    "pii",
+    "sensitive data",
+    "authentication",
+    "authorization",
+  ]
+---
+
+# Flutter/Dart Security Reviewer
+
+## Overview
+
+This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
+
+## When to Use
+
+- Reviewing code that handles authentication tokens
+- Implementing secure storage for sensitive data
+- Adding logging/analytics that might expose PII
+- Reviewing network requests for security issues
+- Implementing biometric authentication
+- Handling user passwords or credentials
+- Processing payment information
+- Storing user preferences that contain sensitive data
+- Implementing session management
+- Any code that touches user data
+
+## Review Output Format
+
+When reviewing, output exactly:
+
+1. **Threat summary** (what could go wrong; 3-6 bullets)
+2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
+3. **Concrete mitigations** (specific code-level steps)
+4. **Security regression tests/checks** (what to verify)
+5. **Logging & privacy audit** (PII, tokens, crash reports)
+
+## Severity Definitions
+
+- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
+- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
+- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
+- **LOW**: Best-practice improvements
+
+---
+
+## 1) Authentication & Session Security
+
+### Tokens
+
+**CRITICAL:**
+- Tokens in logs, analytics events, crash reports
+- Tokens stored in plain SharedPreferences without justification
+
+**Recommendations:**
+- Prefer secure storage for tokens (platform-backed) where possible
+- If SharedPreferences must be used, ensure:
+  - Short-lived access tokens + refresh tokens handled carefully
+  - Minimal token surface; never log
+
+### Route Guards
+- Ensure router guards cannot be bypassed by deep links
+- Guard decisions must use authoritative session provider state
+- Avoid redirect loops (secure + usability)
+
+---
+
+## 2) Network Security
+
+### Checklist
+- [ ] Use HTTPS in UAT/Prod baseUrl
+- [ ] Reasonable timeouts (connect/receive)
+- [ ] Avoid disabling cert validation
+- [ ] Do not accept all certs in production
+- [ ] Interceptors must not log sensitive headers or body fields
+
+### Retry Policy
+- Avoid retrying non-idempotent requests unless safe
+- Backoff + max attempts
+
+### Device ↔ Gateway Security
+- Prefer server-side validation and proper auth
+- Never "security-by-obscurity" headers
+
+---
+
+## 3) Local Data Protection
+
+**CRITICAL:**
+- Storing PII or tokens unencrypted without threat model
+
+**Guidance:**
+- Store only what's needed offline
+- Encrypt sensitive cached blobs if possible, or avoid caching them
+- Apply TTL to cached session/profile data
+- Clear data on logout
+
+---
+
+## 4) Input Validation & Injection Safety
+
+- [ ] Validate all user inputs before sending to API
+- [ ] Avoid string interpolation for SQL queries: use parameters
+- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
+
+---
+
+## 5) Privacy, Logging, Analytics
+
+**CRITICAL:**
+- PII in logs (`name`, `phone`, `location`, identifiers)
+- Tokens/headers in logs
+- Crashlytics sending PII
+
+**Guidance:**
+- Redact: Authorization headers, cookies, IDs if sensitive
+- Provide `toSafeLog()` helpers
+- Ensure debug logging is disabled/limited in release builds
+
+---
+
+## 6) Dependency & Supply Chain Hygiene
+
+- [ ] Check new packages are reputable and maintained
+- [ ] Avoid adding packages that request broad permissions without need
+- [ ] Pin versions as appropriate; review changelogs for security fixes
+
+---
+
+## 7) Security Review Checklist for PRs
+
+### Always Search For
+- `print(`, `debugPrint(`, logging interceptors
+- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
+- `badCertificateCallback`, `HttpClient` overrides
+- Persistent storage of user/session data
+
+### Enforce
+- [ ] No secrets in repo
+- [ ] No insecure network overrides in production
+- [ ] Logout clears sensitive local data
+- [ ] Access control enforced server-side (don't trust client role/org headers alone)
+
+---
+
+## Quick Reference
+
+### Secure Storage (DO)
+
+```dart
+// ✅ Use flutter_secure_storage for tokens
+final storage = FlutterSecureStorage();
+await storage.write(key: 'auth_token', value: token);
+```
+
+### Secure Storage (DON'T)
+
+```dart
+// ❌ Never store tokens in SharedPreferences
+final prefs = await SharedPreferences.getInstance();
+prefs.setString('auth_token', token); // INSECURE!
+
+// ❌ Never hardcode secrets
+const apiKey = 'sk_live_abc123'; // NEVER DO THIS
+```
+
+### Log Redaction
+
+```dart
+// ❌ Bad - logs sensitive data
+logger.info('User login: ${user.email}, password: ${password}');
+
+// ✅ Good - no sensitive data in logs
+logger.info('User login successful: userId=${user.id}');
+```
+
+---
+
+## Steering Files
+
+| File                        | Load When                              |
+| --------------------------- | -------------------------------------- |
+| `secure_storage_policy.md`  | What to store where                    |
+| `network_hardening.md`      | Network security best practices        |
+| `log_redaction.md`          | How to redact sensitive data from logs |
+| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
+| `secret-scanning.md`        | Finding hardcoded secrets              |
+
+## Templates
+
+- `security_review_response.md` - Security review report template

package/Ai Agent Workflow/powers/flutter-security-reviewer/steering/log_redaction.md

@@ -0,0 +1,17 @@
+# Logging redaction policy
+
+## Never log
+- Authorization headers
+- Cookies
+- refresh/access tokens
+- passwords/OTP codes
+- full request/response bodies containing PII
+
+## Recommended
+- Log request method + path + status code
+- Log timing and correlation ids
+- Redact sensitive fields:
+
+Example (pseudo):
+- headers: replace Authorization with "***"
+- body: replace keys like token/password with "***"

package/Ai Agent Workflow/powers/flutter-security-reviewer/steering/network_hardening.md

@@ -0,0 +1,13 @@
+# Network hardening (Dio)
+
+Checklist:
+- HTTPS only for UAT/Prod
+- Timeouts configured
+- Interceptors do not leak sensitive info
+- No `badCertificateCallback` in release
+- Use request IDs/transaction hashes for tracing (non-secret)
+
+Retry policy:
+- idempotent requests only (GET)
+- exponential backoff
+- cap attempts

package/Ai Agent Workflow/powers/flutter-security-reviewer/steering/secret-scanning.md

@@ -0,0 +1,123 @@
+# Secret Scanning
+
+> Reference for: Security Reviewer
+> Load when: Scanning for hardcoded secrets
+
+## Manual Grep Patterns
+
+```bash
+# Common secret patterns
+grep -rn "api_key\|apikey\|api-key" --include="*.dart" .
+grep -rn "secret\|password\|passwd" --include="*.dart" .
+grep -rn "private_key\|privatekey" --include="*.dart" .
+grep -rn "access_token\|accesstoken" --include="*.dart" .
+
+# Firebase/Google
+grep -rn "AIza[0-9A-Za-z_-]{35}" .
+grep -rn "firebase" --include="*.dart" .
+
+# AWS credentials
+grep -rn "AKIA[0-9A-Z]{16}" .
+grep -rn "aws_secret_access_key" .
+
+# Base64 encoded (potential secrets)
+grep -rn "[A-Za-z0-9+/]{40,}=" .
+
+# JWT tokens
+grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .
+```
+
+## Common Secret Patterns
+
+| Type              | Pattern                          | Example                    |
+| ----------------- | -------------------------------- | -------------------------- |
+| AWS Access Key    | `AKIA[0-9A-Z]{16}`               | AKIAIOSFODNN7EXAMPLE       |
+| AWS Secret Key    | 40 char base64                   | wJalrXUtnFEMI/K7MDENG...   |
+| Firebase API Key  | `AIza[0-9A-Za-z_-]{35}`          | AIzaSyC...                 |
+| GitHub Token      | `ghp_[A-Za-z0-9]{36}`            | ghp_xxxxxxxxxxxx           |
+| Slack Token       | `xox[baprs]-`                    | xoxb-xxx-xxx               |
+| Stripe Key        | `sk_live_[A-Za-z0-9]{24}`        | sk_live_xxxx               |
+| Private Key       | `-----BEGIN.*PRIVATE KEY-----`  | RSA/EC keys                |
+| JWT               | `eyJ[A-Za-z0-9_-]*\.eyJ`         | Encoded tokens             |
+
+## Flutter-Specific Locations to Check
+
+```bash
+# Check these files for hardcoded secrets
+lib/core/config/
+lib/firebase_options.dart
+android/app/google-services.json
+ios/Runner/GoogleService-Info.plist
+.env files
+pubspec.yaml (sometimes contains keys)
+```
+
+## What to Look For
+
+### Hardcoded API Keys
+```dart
+// BAD - Hardcoded
+const apiKey = 'sk_live_abc123xyz';
+const firebaseKey = 'AIzaSyC...';
+
+// GOOD - Environment variable or secure storage
+final apiKey = const String.fromEnvironment('API_KEY');
+final apiKey = await secureStorage.read(key: 'api_key');
+```
+
+### Hardcoded URLs with Credentials
+```dart
+// BAD
+const dbUrl = 'postgres://user:password@host:5432/db';
+
+// GOOD
+final dbUrl = const String.fromEnvironment('DATABASE_URL');
+```
+
+### Debug/Test Credentials
+```dart
+// BAD - Test credentials in production code
+const testUser = 'admin';
+const testPassword = 'admin123';
+
+// GOOD - Only in test files, never committed
+// Use environment variables or test fixtures
+```
+
+## Remediation Steps
+
+1. **Rotate immediately** - Consider secret compromised
+2. **Remove from code** - Replace with environment variable
+3. **Remove from git history** - Use BFG or git filter-branch
+4. **Add to .gitignore** - Prevent future commits
+5. **Use secure storage** - flutter_secure_storage for runtime secrets
+6. **Use --dart-define** - For build-time configuration
+
+```bash
+# Build with environment variables
+flutter build apk --dart-define=API_KEY=$API_KEY
+
+# Access in code
+const apiKey = String.fromEnvironment('API_KEY');
+```
+
+## Pre-commit Prevention
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.0
+    hooks:
+      - id: gitleaks
+```
+
+## Quick Reference
+
+| Location                    | Risk Level | Action                      |
+| --------------------------- | ---------- | --------------------------- |
+| Source code (.dart)         | Critical   | Remove, use env vars        |
+| Config files                | High       | Move to .gitignore          |
+| Git history                 | Critical   | Rewrite history             |
+| Build artifacts             | Medium     | Ensure not committed        |
+| Comments/TODOs              | Medium     | Remove sensitive info       |

package/Ai Agent Workflow/powers/flutter-security-reviewer/steering/secure_storage_policy.md

@@ -0,0 +1,16 @@
+# Secure storage policy (mobile)
+
+## Token storage
+Preferred:
+- Platform-backed secure storage for auth tokens
+
+If you must use SharedPreferences:
+- access tokens should be short-lived
+- never store refresh token unless encrypted/secured
+- clear all tokens on logout
+- guard against backup/restore exposures where relevant
+
+## Cached user/profile data
+- Apply TTL
+- Avoid caching sensitive PII unless required for offline
+- Clear per-organization/user on logout or org switch

package/Ai Agent Workflow/powers/flutter-security-reviewer/steering/vulnerability-patterns.md

@@ -0,0 +1,189 @@
+# Vulnerability Patterns
+
+> Reference for: Security Reviewer
+> Load when: Manual security code review
+
+## SQL/NoSQL Injection
+
+```dart
+// VULNERABLE - String interpolation
+final query = "SELECT * FROM users WHERE id = $userId";
+
+// SECURE - Parameterized queries (Sqflite)
+final result = await db.query(
+  'users',
+  where: 'id = ?',
+  whereArgs: [userId],
+);
+
+// SECURE - ORM (Isar)
+final user = await isar.users.filter().idEqualTo(userId).findFirst();
+```
+
+## Path Traversal
+
+```dart
+// VULNERABLE
+final file = File('$uploadDir/${request.filename}');
+
+// SECURE - Validate and normalize
+final filename = path.basename(request.filename);
+final file = File(path.join(uploadDir, filename));
+
+// Verify path is within allowed directory
+if (!file.path.startsWith(path.canonicalize(uploadDir))) {
+  throw SecurityException('Invalid path');
+}
+```
+
+## Insecure Direct Object Reference (IDOR)
+
+```dart
+// VULNERABLE - No authorization check
+Future<Document> getDocument(String docId) async {
+  return await documentRepository.findById(docId);
+}
+
+// SECURE - Verify ownership
+Future<Document> getDocument(String docId, String userId) async {
+  final doc = await documentRepository.findById(docId);
+  if (doc.ownerId != userId) {
+    throw UnauthorizedException('Access denied');
+  }
+  return doc;
+}
+```
+
+## Sensitive Data Exposure
+
+```dart
+// VULNERABLE - Logging sensitive data
+logger.info('User login: email=$email, password=$password');
+logger.debug('Token: $authToken');
+
+// SECURE - Redact sensitive fields
+logger.info('User login: email=$email');
+logger.debug('Token: [REDACTED]');
+
+// VULNERABLE - Error response exposes internals
+return Response.error(exception.stackTrace.toString());
+
+// SECURE - Generic error
+return Response.error('An error occurred');
+```
+
+## Insecure Storage
+
+```dart
+// VULNERABLE - Plain SharedPreferences for tokens
+final prefs = await SharedPreferences.getInstance();
+await prefs.setString('auth_token', token);
+
+// SECURE - Use flutter_secure_storage
+final storage = FlutterSecureStorage();
+await storage.write(key: 'auth_token', value: token);
+
+// VULNERABLE - Unencrypted Isar for sensitive data
+final isar = await Isar.open([UserSchema]);
+
+// SECURE - Encrypted Isar
+final isar = await Isar.open(
+  [UserSchema],
+  encryptionKey: encryptionKey,
+);
+```
+
+## Authentication Bypass
+
+```dart
+// VULNERABLE - Client-side only check
+if (user.role == 'admin') {
+  showAdminPanel();
+}
+
+// SECURE - Server validates, client just displays
+// Server: verify role in JWT/session before returning admin data
+// Client: display based on server response
+
+// VULNERABLE - Trusting client headers
+final orgId = request.headers['X-Org-Id'];
+
+// SECURE - Derive from authenticated session
+final orgId = authenticatedUser.organizationId;
+```
+
+## Session Management Issues
+
+```dart
+// VULNERABLE - No session timeout
+// Token never expires
+
+// SECURE - Short-lived access tokens + refresh
+final accessToken = jwt.sign(
+  payload,
+  secret,
+  expiresIn: Duration(minutes: 15),
+);
+
+// VULNERABLE - Session not cleared on logout
+Future<void> logout() async {
+  // Just navigate away
+  context.go('/login');
+}
+
+// SECURE - Clear all sensitive data
+Future<void> logout() async {
+  await secureStorage.deleteAll();
+  await isar.writeTxn(() => isar.clear());
+  ref.invalidate(sessionProvider);
+  context.go('/login');
+}
+```
+
+## Deep Link Security
+
+```dart
+// VULNERABLE - No auth check on deep link
+GoRoute(
+  path: '/document/:id',
+  builder: (context, state) => DocumentView(id: state.params['id']!),
+)
+
+// SECURE - Guard protects deep links
+GoRoute(
+  path: '/document/:id',
+  redirect: (context, state) {
+    if (!isAuthenticated) return '/login?redirect=${state.uri}';
+    return null;
+  },
+  builder: (context, state) => DocumentView(id: state.params['id']!),
+)
+```
+
+## Quick Reference
+
+| Vulnerability     | Input Vector    | Prevention                    |
+| ----------------- | --------------- | ----------------------------- |
+| SQL Injection     | Query params    | Parameterized queries         |
+| Path Traversal    | File paths      | path.basename + validation    |
+| IDOR              | Resource IDs    | Authorization checks          |
+| Data Exposure     | Logs, errors    | Redaction, generic errors     |
+| Insecure Storage  | Local storage   | flutter_secure_storage        |
+| Auth Bypass       | Client checks   | Server-side validation        |
+| Session Issues    | Token handling  | Short TTL, proper logout      |
+| Deep Link Bypass  | URL schemes     | Route guards                  |
+
+## OWASP Mobile Top 10 Mapping
+
+| OWASP Mobile              | Vulnerabilities                    |
+| ------------------------- | ---------------------------------- |
+| M1 Improper Platform Use  | Insecure storage, deep link bypass |
+| M2 Insecure Data Storage  | SharedPreferences for tokens       |
+| M3 Insecure Communication | HTTP, no cert pinning              |
+| M4 Insecure Authentication| Weak session, no timeout           |
+| M5 Insufficient Crypto    | Weak encryption, hardcoded keys    |
+| M6 Insecure Authorization | IDOR, client-side checks           |
+| M7 Client Code Quality    | Injection, path traversal          |
+| M8 Code Tampering         | No integrity checks                |
+| M9 Reverse Engineering    | Hardcoded secrets                  |
+| M10 Extraneous Functionality | Debug endpoints, test data      |

package/Ai Agent Workflow/powers/flutter-security-reviewer/templates/security_review_response.md

@@ -0,0 +1,31 @@
+# Security Review (OneUp HR)
+
+## Threat summary
+- ...
+
+## Findings
+
+### CRITICAL
+- **...**
+  - Risk:
+  - Evidence:
+  - Fix:
+
+### HIGH
+- ...
+
+### MED
+- ...
+
+### LOW
+- ...
+
+## Concrete mitigations
+1) ...
+2) ...
+
+## Security regression checks
+- [ ] ...
+
+## Logging & privacy audit
+- ...