@cubis/foundry 0.3.30 → 0.3.32

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-expert/references/widget-patterns.md

@@ -0,0 +1,123 @@
+# Widget Patterns
+
+## Optimized Widget Pattern
+
+```dart
+// Use const constructors
+class OptimizedCard extends StatelessWidget {
+  final String title;
+  final VoidCallback onTap;
+
+  const OptimizedCard({
+    super.key,
+    required this.title,
+    required this.onTap,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Card(
+      child: InkWell(
+        onTap: onTap,
+        child: Padding(
+          padding: const EdgeInsets.all(16),
+          child: Text(title, style: Theme.of(context).textTheme.titleMedium),
+        ),
+      ),
+    );
+  }
+}
+```
+
+## Responsive Layout
+
+```dart
+class ResponsiveLayout extends StatelessWidget {
+  final Widget mobile;
+  final Widget? tablet;
+  final Widget desktop;
+
+  const ResponsiveLayout({
+    super.key,
+    required this.mobile,
+    this.tablet,
+    required this.desktop,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return LayoutBuilder(
+      builder: (context, constraints) {
+        if (constraints.maxWidth >= 1100) return desktop;
+        if (constraints.maxWidth >= 650) return tablet ?? mobile;
+        return mobile;
+      },
+    );
+  }
+}
+```
+
+## Custom Hooks (flutter_hooks)
+
+```dart
+import 'package:flutter_hooks/flutter_hooks.dart';
+
+class CounterWidget extends HookWidget {
+  @override
+  Widget build(BuildContext context) {
+    final counter = useState(0);
+    final controller = useTextEditingController();
+
+    useEffect(() {
+      // Setup
+      return () {
+        // Cleanup
+      };
+    }, []);
+
+    return Column(
+      children: [
+        Text('Count: ${counter.value}'),
+        ElevatedButton(
+          onPressed: () => counter.value++,
+          child: const Text('Increment'),
+        ),
+      ],
+    );
+  }
+}
+```
+
+## Sliver Patterns
+
+```dart
+CustomScrollView(
+  slivers: [
+    SliverAppBar(
+      expandedHeight: 200,
+      pinned: true,
+      flexibleSpace: FlexibleSpaceBar(
+        title: const Text('Title'),
+        background: Image.network(imageUrl, fit: BoxFit.cover),
+      ),
+    ),
+    SliverList(
+      delegate: SliverChildBuilderDelegate(
+        (context, index) => ListTile(title: Text('Item $index')),
+        childCount: 100,
+      ),
+    ),
+  ],
+)
+```
+
+## Key Optimization Patterns
+
+| Pattern | Implementation |
+|---------|----------------|
+| **const widgets** | Add `const` to static widgets |
+| **keys** | Use `Key` for list items |
+| **select** | `ref.watch(provider.select(...))` |
+| **RepaintBoundary** | Isolate expensive repaints |
+| **ListView.builder** | Lazy loading for lists |
+| **const constructors** | Always use when possible |

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/POWER.md

@@ -0,0 +1,204 @@
+---
+name: "flutter-security-reviewer"
+displayName: "Flutter/Dart Security Reviewer"
+description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
+keywords:
+  [
+    "security",
+    "flutter security",
+    "dart security",
+    "secure storage",
+    "encryption",
+    "log redaction",
+    "network security",
+    "data protection",
+    "pii",
+    "sensitive data",
+    "authentication",
+    "authorization",
+  ]
+---
+
+# Flutter/Dart Security Reviewer
+
+## Overview
+
+This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
+
+## When to Use
+
+- Reviewing code that handles authentication tokens
+- Implementing secure storage for sensitive data
+- Adding logging/analytics that might expose PII
+- Reviewing network requests for security issues
+- Implementing biometric authentication
+- Handling user passwords or credentials
+- Processing payment information
+- Storing user preferences that contain sensitive data
+- Implementing session management
+- Any code that touches user data
+
+## Review Output Format
+
+When reviewing, output exactly:
+
+1. **Threat summary** (what could go wrong; 3-6 bullets)
+2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
+3. **Concrete mitigations** (specific code-level steps)
+4. **Security regression tests/checks** (what to verify)
+5. **Logging & privacy audit** (PII, tokens, crash reports)
+
+## Severity Definitions
+
+- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
+- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
+- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
+- **LOW**: Best-practice improvements
+
+---
+
+## 1) Authentication & Session Security
+
+### Tokens
+
+**CRITICAL:**
+- Tokens in logs, analytics events, crash reports
+- Tokens stored in plain SharedPreferences without justification
+
+**Recommendations:**
+- Prefer secure storage for tokens (platform-backed) where possible
+- If SharedPreferences must be used, ensure:
+  - Short-lived access tokens + refresh tokens handled carefully
+  - Minimal token surface; never log
+
+### Route Guards
+- Ensure router guards cannot be bypassed by deep links
+- Guard decisions must use authoritative session provider state
+- Avoid redirect loops (secure + usability)
+
+---
+
+## 2) Network Security
+
+### Checklist
+- [ ] Use HTTPS in UAT/Prod baseUrl
+- [ ] Reasonable timeouts (connect/receive)
+- [ ] Avoid disabling cert validation
+- [ ] Do not accept all certs in production
+- [ ] Interceptors must not log sensitive headers or body fields
+
+### Retry Policy
+- Avoid retrying non-idempotent requests unless safe
+- Backoff + max attempts
+
+### Device ↔ Gateway Security
+- Prefer server-side validation and proper auth
+- Never "security-by-obscurity" headers
+
+---
+
+## 3) Local Data Protection
+
+**CRITICAL:**
+- Storing PII or tokens unencrypted without threat model
+
+**Guidance:**
+- Store only what's needed offline
+- Encrypt sensitive cached blobs if possible, or avoid caching them
+- Apply TTL to cached session/profile data
+- Clear data on logout
+
+---
+
+## 4) Input Validation & Injection Safety
+
+- [ ] Validate all user inputs before sending to API
+- [ ] Avoid string interpolation for SQL queries: use parameters
+- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
+
+---
+
+## 5) Privacy, Logging, Analytics
+
+**CRITICAL:**
+- PII in logs (`name`, `phone`, `location`, identifiers)
+- Tokens/headers in logs
+- Crashlytics sending PII
+
+**Guidance:**
+- Redact: Authorization headers, cookies, IDs if sensitive
+- Provide `toSafeLog()` helpers
+- Ensure debug logging is disabled/limited in release builds
+
+---
+
+## 6) Dependency & Supply Chain Hygiene
+
+- [ ] Check new packages are reputable and maintained
+- [ ] Avoid adding packages that request broad permissions without need
+- [ ] Pin versions as appropriate; review changelogs for security fixes
+
+---
+
+## 7) Security Review Checklist for PRs
+
+### Always Search For
+- `print(`, `debugPrint(`, logging interceptors
+- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
+- `badCertificateCallback`, `HttpClient` overrides
+- Persistent storage of user/session data
+
+### Enforce
+- [ ] No secrets in repo
+- [ ] No insecure network overrides in production
+- [ ] Logout clears sensitive local data
+- [ ] Access control enforced server-side (don't trust client role/org headers alone)
+
+---
+
+## Quick Reference
+
+### Secure Storage (DO)
+
+```dart
+// ✅ Use flutter_secure_storage for tokens
+final storage = FlutterSecureStorage();
+await storage.write(key: 'auth_token', value: token);
+```
+
+### Secure Storage (DON'T)
+
+```dart
+// ❌ Never store tokens in SharedPreferences
+final prefs = await SharedPreferences.getInstance();
+prefs.setString('auth_token', token); // INSECURE!
+
+// ❌ Never hardcode secrets
+const apiKey = 'sk_live_abc123'; // NEVER DO THIS
+```
+
+### Log Redaction
+
+```dart
+// ❌ Bad - logs sensitive data
+logger.info('User login: ${user.email}, password: ${password}');
+
+// ✅ Good - no sensitive data in logs
+logger.info('User login successful: userId=${user.id}');
+```
+
+---
+
+## Steering Files
+
+| File                        | Load When                              |
+| --------------------------- | -------------------------------------- |
+| `secure_storage_policy.md`  | What to store where                    |
+| `network_hardening.md`      | Network security best practices        |
+| `log_redaction.md`          | How to redact sensitive data from logs |
+| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
+| `secret-scanning.md`        | Finding hardcoded secrets              |
+
+## Templates
+
+- `security_review_response.md` - Security review report template

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/SKILL.md

@@ -0,0 +1,204 @@
+---
+name: "flutter-security-reviewer"
+displayName: "Flutter/Dart Security Reviewer"
+description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
+keywords:
+  [
+    "security",
+    "flutter security",
+    "dart security",
+    "secure storage",
+    "encryption",
+    "log redaction",
+    "network security",
+    "data protection",
+    "pii",
+    "sensitive data",
+    "authentication",
+    "authorization",
+  ]
+---
+
+# Flutter/Dart Security Reviewer
+
+## Overview
+
+This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
+
+## When to Use
+
+- Reviewing code that handles authentication tokens
+- Implementing secure storage for sensitive data
+- Adding logging/analytics that might expose PII
+- Reviewing network requests for security issues
+- Implementing biometric authentication
+- Handling user passwords or credentials
+- Processing payment information
+- Storing user preferences that contain sensitive data
+- Implementing session management
+- Any code that touches user data
+
+## Review Output Format
+
+When reviewing, output exactly:
+
+1. **Threat summary** (what could go wrong; 3-6 bullets)
+2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
+3. **Concrete mitigations** (specific code-level steps)
+4. **Security regression tests/checks** (what to verify)
+5. **Logging & privacy audit** (PII, tokens, crash reports)
+
+## Severity Definitions
+
+- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
+- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
+- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
+- **LOW**: Best-practice improvements
+
+---
+
+## 1) Authentication & Session Security
+
+### Tokens
+
+**CRITICAL:**
+- Tokens in logs, analytics events, crash reports
+- Tokens stored in plain SharedPreferences without justification
+
+**Recommendations:**
+- Prefer secure storage for tokens (platform-backed) where possible
+- If SharedPreferences must be used, ensure:
+  - Short-lived access tokens + refresh tokens handled carefully
+  - Minimal token surface; never log
+
+### Route Guards
+- Ensure router guards cannot be bypassed by deep links
+- Guard decisions must use authoritative session provider state
+- Avoid redirect loops (secure + usability)
+
+---
+
+## 2) Network Security
+
+### Checklist
+- [ ] Use HTTPS in UAT/Prod baseUrl
+- [ ] Reasonable timeouts (connect/receive)
+- [ ] Avoid disabling cert validation
+- [ ] Do not accept all certs in production
+- [ ] Interceptors must not log sensitive headers or body fields
+
+### Retry Policy
+- Avoid retrying non-idempotent requests unless safe
+- Backoff + max attempts
+
+### Device ↔ Gateway Security
+- Prefer server-side validation and proper auth
+- Never "security-by-obscurity" headers
+
+---
+
+## 3) Local Data Protection
+
+**CRITICAL:**
+- Storing PII or tokens unencrypted without threat model
+
+**Guidance:**
+- Store only what's needed offline
+- Encrypt sensitive cached blobs if possible, or avoid caching them
+- Apply TTL to cached session/profile data
+- Clear data on logout
+
+---
+
+## 4) Input Validation & Injection Safety
+
+- [ ] Validate all user inputs before sending to API
+- [ ] Avoid string interpolation for SQL queries: use parameters
+- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
+
+---
+
+## 5) Privacy, Logging, Analytics
+
+**CRITICAL:**
+- PII in logs (`name`, `phone`, `location`, identifiers)
+- Tokens/headers in logs
+- Crashlytics sending PII
+
+**Guidance:**
+- Redact: Authorization headers, cookies, IDs if sensitive
+- Provide `toSafeLog()` helpers
+- Ensure debug logging is disabled/limited in release builds
+
+---
+
+## 6) Dependency & Supply Chain Hygiene
+
+- [ ] Check new packages are reputable and maintained
+- [ ] Avoid adding packages that request broad permissions without need
+- [ ] Pin versions as appropriate; review changelogs for security fixes
+
+---
+
+## 7) Security Review Checklist for PRs
+
+### Always Search For
+- `print(`, `debugPrint(`, logging interceptors
+- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
+- `badCertificateCallback`, `HttpClient` overrides
+- Persistent storage of user/session data
+
+### Enforce
+- [ ] No secrets in repo
+- [ ] No insecure network overrides in production
+- [ ] Logout clears sensitive local data
+- [ ] Access control enforced server-side (don't trust client role/org headers alone)
+
+---
+
+## Quick Reference
+
+### Secure Storage (DO)
+
+```dart
+// ✅ Use flutter_secure_storage for tokens
+final storage = FlutterSecureStorage();
+await storage.write(key: 'auth_token', value: token);
+```
+
+### Secure Storage (DON'T)
+
+```dart
+// ❌ Never store tokens in SharedPreferences
+final prefs = await SharedPreferences.getInstance();
+prefs.setString('auth_token', token); // INSECURE!
+
+// ❌ Never hardcode secrets
+const apiKey = 'sk_live_abc123'; // NEVER DO THIS
+```
+
+### Log Redaction
+
+```dart
+// ❌ Bad - logs sensitive data
+logger.info('User login: ${user.email}, password: ${password}');
+
+// ✅ Good - no sensitive data in logs
+logger.info('User login successful: userId=${user.id}');
+```
+
+---
+
+## Steering Files
+
+| File                        | Load When                              |
+| --------------------------- | -------------------------------------- |
+| `secure_storage_policy.md`  | What to store where                    |
+| `network_hardening.md`      | Network security best practices        |
+| `log_redaction.md`          | How to redact sensitive data from logs |
+| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
+| `secret-scanning.md`        | Finding hardcoded secrets              |
+
+## Templates
+
+- `security_review_response.md` - Security review report template

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/references/log_redaction.md

@@ -0,0 +1,17 @@
+# Logging redaction policy
+
+## Never log
+- Authorization headers
+- Cookies
+- refresh/access tokens
+- passwords/OTP codes
+- full request/response bodies containing PII
+
+## Recommended
+- Log request method + path + status code
+- Log timing and correlation ids
+- Redact sensitive fields:
+
+Example (pseudo):
+- headers: replace Authorization with "***"
+- body: replace keys like token/password with "***"

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/references/network_hardening.md

@@ -0,0 +1,13 @@
+# Network hardening (Dio)
+
+Checklist:
+- HTTPS only for UAT/Prod
+- Timeouts configured
+- Interceptors do not leak sensitive info
+- No `badCertificateCallback` in release
+- Use request IDs/transaction hashes for tracing (non-secret)
+
+Retry policy:
+- idempotent requests only (GET)
+- exponential backoff
+- cap attempts

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/references/secret-scanning.md

@@ -0,0 +1,123 @@
+# Secret Scanning
+
+> Reference for: Security Reviewer
+> Load when: Scanning for hardcoded secrets
+
+## Manual Grep Patterns
+
+```bash
+# Common secret patterns
+grep -rn "api_key\|apikey\|api-key" --include="*.dart" .
+grep -rn "secret\|password\|passwd" --include="*.dart" .
+grep -rn "private_key\|privatekey" --include="*.dart" .
+grep -rn "access_token\|accesstoken" --include="*.dart" .
+
+# Firebase/Google
+grep -rn "AIza[0-9A-Za-z_-]{35}" .
+grep -rn "firebase" --include="*.dart" .
+
+# AWS credentials
+grep -rn "AKIA[0-9A-Z]{16}" .
+grep -rn "aws_secret_access_key" .
+
+# Base64 encoded (potential secrets)
+grep -rn "[A-Za-z0-9+/]{40,}=" .
+
+# JWT tokens
+grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .
+```
+
+## Common Secret Patterns
+
+| Type              | Pattern                          | Example                    |
+| ----------------- | -------------------------------- | -------------------------- |
+| AWS Access Key    | `AKIA[0-9A-Z]{16}`               | AKIAIOSFODNN7EXAMPLE       |
+| AWS Secret Key    | 40 char base64                   | wJalrXUtnFEMI/K7MDENG...   |
+| Firebase API Key  | `AIza[0-9A-Za-z_-]{35}`          | AIzaSyC...                 |
+| GitHub Token      | `ghp_[A-Za-z0-9]{36}`            | ghp_xxxxxxxxxxxx           |
+| Slack Token       | `xox[baprs]-`                    | xoxb-xxx-xxx               |
+| Stripe Key        | `sk_live_[A-Za-z0-9]{24}`        | sk_live_xxxx               |
+| Private Key       | `-----BEGIN.*PRIVATE KEY-----`  | RSA/EC keys                |
+| JWT               | `eyJ[A-Za-z0-9_-]*\.eyJ`         | Encoded tokens             |
+
+## Flutter-Specific Locations to Check
+
+```bash
+# Check these files for hardcoded secrets
+lib/core/config/
+lib/firebase_options.dart
+android/app/google-services.json
+ios/Runner/GoogleService-Info.plist
+.env files
+pubspec.yaml (sometimes contains keys)
+```
+
+## What to Look For
+
+### Hardcoded API Keys
+```dart
+// BAD - Hardcoded
+const apiKey = 'sk_live_abc123xyz';
+const firebaseKey = 'AIzaSyC...';
+
+// GOOD - Environment variable or secure storage
+final apiKey = const String.fromEnvironment('API_KEY');
+final apiKey = await secureStorage.read(key: 'api_key');
+```
+
+### Hardcoded URLs with Credentials
+```dart
+// BAD
+const dbUrl = 'postgres://user:password@host:5432/db';
+
+// GOOD
+final dbUrl = const String.fromEnvironment('DATABASE_URL');
+```
+
+### Debug/Test Credentials
+```dart
+// BAD - Test credentials in production code
+const testUser = 'admin';
+const testPassword = 'admin123';
+
+// GOOD - Only in test files, never committed
+// Use environment variables or test fixtures
+```
+
+## Remediation Steps
+
+1. **Rotate immediately** - Consider secret compromised
+2. **Remove from code** - Replace with environment variable
+3. **Remove from git history** - Use BFG or git filter-branch
+4. **Add to .gitignore** - Prevent future commits
+5. **Use secure storage** - flutter_secure_storage for runtime secrets
+6. **Use --dart-define** - For build-time configuration
+
+```bash
+# Build with environment variables
+flutter build apk --dart-define=API_KEY=$API_KEY
+
+# Access in code
+const apiKey = String.fromEnvironment('API_KEY');
+```
+
+## Pre-commit Prevention
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.0
+    hooks:
+      - id: gitleaks
+```
+
+## Quick Reference
+
+| Location                    | Risk Level | Action                      |
+| --------------------------- | ---------- | --------------------------- |
+| Source code (.dart)         | Critical   | Remove, use env vars        |
+| Config files                | High       | Move to .gitignore          |
+| Git history                 | Critical   | Rewrite history             |
+| Build artifacts             | Medium     | Ensure not committed        |
+| Comments/TODOs              | Medium     | Remove sensitive info       |

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/references/secure_storage_policy.md

@@ -0,0 +1,16 @@
+# Secure storage policy (mobile)
+
+## Token storage
+Preferred:
+- Platform-backed secure storage for auth tokens
+
+If you must use SharedPreferences:
+- access tokens should be short-lived
+- never store refresh token unless encrypted/secured
+- clear all tokens on logout
+- guard against backup/restore exposures where relevant
+
+## Cached user/profile data
+- Apply TTL
+- Avoid caching sensitive PII unless required for offline
+- Clear per-organization/user on logout or org switch