@cubis/foundry 0.3.34 → 0.3.36

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/flutter-security-reviewer/POWER.md

@@ -1,204 +0,0 @@
----
-name: "flutter-security-reviewer"
-displayName: "Flutter/Dart Security Reviewer"
-description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
-keywords:
-  [
-    "security",
-    "flutter security",
-    "dart security",
-    "secure storage",
-    "encryption",
-    "log redaction",
-    "network security",
-    "data protection",
-    "pii",
-    "sensitive data",
-    "authentication",
-    "authorization",
-  ]
----
-
-# Flutter/Dart Security Reviewer
-
-## Overview
-
-This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
-
-## When to Use
-
-- Reviewing code that handles authentication tokens
-- Implementing secure storage for sensitive data
-- Adding logging/analytics that might expose PII
-- Reviewing network requests for security issues
-- Implementing biometric authentication
-- Handling user passwords or credentials
-- Processing payment information
-- Storing user preferences that contain sensitive data
-- Implementing session management
-- Any code that touches user data
-
-## Review Output Format
-
-When reviewing, output exactly:
-
-1. **Threat summary** (what could go wrong; 3-6 bullets)
-2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
-3. **Concrete mitigations** (specific code-level steps)
-4. **Security regression tests/checks** (what to verify)
-5. **Logging & privacy audit** (PII, tokens, crash reports)
-
-## Severity Definitions
-
-- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
-- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
-- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
-- **LOW**: Best-practice improvements
-
----
-
-## 1) Authentication & Session Security
-
-### Tokens
-
-**CRITICAL:**
-- Tokens in logs, analytics events, crash reports
-- Tokens stored in plain SharedPreferences without justification
-
-**Recommendations:**
-- Prefer secure storage for tokens (platform-backed) where possible
-- If SharedPreferences must be used, ensure:
-  - Short-lived access tokens + refresh tokens handled carefully
-  - Minimal token surface; never log
-
-### Route Guards
-- Ensure router guards cannot be bypassed by deep links
-- Guard decisions must use authoritative session provider state
-- Avoid redirect loops (secure + usability)
-
----
-
-## 2) Network Security
-
-### Checklist
-- [ ] Use HTTPS in UAT/Prod baseUrl
-- [ ] Reasonable timeouts (connect/receive)
-- [ ] Avoid disabling cert validation
-- [ ] Do not accept all certs in production
-- [ ] Interceptors must not log sensitive headers or body fields
-
-### Retry Policy
-- Avoid retrying non-idempotent requests unless safe
-- Backoff + max attempts
-
-### Device ↔ Gateway Security
-- Prefer server-side validation and proper auth
-- Never "security-by-obscurity" headers
-
----
-
-## 3) Local Data Protection
-
-**CRITICAL:**
-- Storing PII or tokens unencrypted without threat model
-
-**Guidance:**
-- Store only what's needed offline
-- Encrypt sensitive cached blobs if possible, or avoid caching them
-- Apply TTL to cached session/profile data
-- Clear data on logout
-
----
-
-## 4) Input Validation & Injection Safety
-
-- [ ] Validate all user inputs before sending to API
-- [ ] Avoid string interpolation for SQL queries: use parameters
-- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
-
----
-
-## 5) Privacy, Logging, Analytics
-
-**CRITICAL:**
-- PII in logs (`name`, `phone`, `location`, identifiers)
-- Tokens/headers in logs
-- Crashlytics sending PII
-
-**Guidance:**
-- Redact: Authorization headers, cookies, IDs if sensitive
-- Provide `toSafeLog()` helpers
-- Ensure debug logging is disabled/limited in release builds
-
----
-
-## 6) Dependency & Supply Chain Hygiene
-
-- [ ] Check new packages are reputable and maintained
-- [ ] Avoid adding packages that request broad permissions without need
-- [ ] Pin versions as appropriate; review changelogs for security fixes
-
----
-
-## 7) Security Review Checklist for PRs
-
-### Always Search For
-- `print(`, `debugPrint(`, logging interceptors
-- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
-- `badCertificateCallback`, `HttpClient` overrides
-- Persistent storage of user/session data
-
-### Enforce
-- [ ] No secrets in repo
-- [ ] No insecure network overrides in production
-- [ ] Logout clears sensitive local data
-- [ ] Access control enforced server-side (don't trust client role/org headers alone)
-
----
-
-## Quick Reference
-
-### Secure Storage (DO)
-
-```dart
-// ✅ Use flutter_secure_storage for tokens
-final storage = FlutterSecureStorage();
-await storage.write(key: 'auth_token', value: token);
-```
-
-### Secure Storage (DON'T)
-
-```dart
-// ❌ Never store tokens in SharedPreferences
-final prefs = await SharedPreferences.getInstance();
-prefs.setString('auth_token', token); // INSECURE!
-
-// ❌ Never hardcode secrets
-const apiKey = 'sk_live_abc123'; // NEVER DO THIS
-```
-
-### Log Redaction
-
-```dart
-// ❌ Bad - logs sensitive data
-logger.info('User login: ${user.email}, password: ${password}');
-
-// ✅ Good - no sensitive data in logs
-logger.info('User login successful: userId=${user.id}');
-```
-
----
-
-## Steering Files
-
-| File                        | Load When                              |
-| --------------------------- | -------------------------------------- |
-| `secure_storage_policy.md`  | What to store where                    |
-| `network_hardening.md`      | Network security best practices        |
-| `log_redaction.md`          | How to redact sensitive data from logs |
-| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
-| `secret-scanning.md`        | Finding hardcoded secrets              |
-
-## Templates
-
-- `security_review_response.md` - Security review report template

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/flutter-security-reviewer/SKILL.md

@@ -1,180 +0,0 @@
----
-name: "flutter-security-reviewer"
-description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
----
-
-
-# Flutter/Dart Security Reviewer
-
-## Overview
-
-This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
-
-## When to Use
-
-- Reviewing code that handles authentication tokens
-- Implementing secure storage for sensitive data
-- Adding logging/analytics that might expose PII
-- Reviewing network requests for security issues
-- Implementing biometric authentication
-- Handling user passwords or credentials
-- Processing payment information
-- Storing user preferences that contain sensitive data
-- Implementing session management
-- Any code that touches user data
-
-## Review Output Format
-
-When reviewing, output exactly:
-
-1. **Threat summary** (what could go wrong; 3-6 bullets)
-2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
-3. **Concrete mitigations** (specific code-level steps)
-4. **Security regression tests/checks** (what to verify)
-5. **Logging & privacy audit** (PII, tokens, crash reports)
-
-## Severity Definitions
-
-- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
-- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
-- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
-- **LOW**: Best-practice improvements
-
-
-## 1) Authentication & Session Security
-
-### Tokens
-
-**CRITICAL:**
-- Tokens in logs, analytics events, crash reports
-- Tokens stored in plain SharedPreferences without justification
-
-**Recommendations:**
-- Prefer secure storage for tokens (platform-backed) where possible
-- If SharedPreferences must be used, ensure:
-  - Short-lived access tokens + refresh tokens handled carefully
-  - Minimal token surface; never log
-
-### Route Guards
-- Ensure router guards cannot be bypassed by deep links
-- Guard decisions must use authoritative session provider state
-- Avoid redirect loops (secure + usability)
-
-
-## 2) Network Security
-
-### Checklist
-- [ ] Use HTTPS in UAT/Prod baseUrl
-- [ ] Reasonable timeouts (connect/receive)
-- [ ] Avoid disabling cert validation
-- [ ] Do not accept all certs in production
-- [ ] Interceptors must not log sensitive headers or body fields
-
-### Retry Policy
-- Avoid retrying non-idempotent requests unless safe
-- Backoff + max attempts
-
-### Device ↔ Gateway Security
-- Prefer server-side validation and proper auth
-- Never "security-by-obscurity" headers
-
-
-## 3) Local Data Protection
-
-**CRITICAL:**
-- Storing PII or tokens unencrypted without threat model
-
-**Guidance:**
-- Store only what's needed offline
-- Encrypt sensitive cached blobs if possible, or avoid caching them
-- Apply TTL to cached session/profile data
-- Clear data on logout
-
-
-## 4) Input Validation & Injection Safety
-
-- [ ] Validate all user inputs before sending to API
-- [ ] Avoid string interpolation for SQL queries: use parameters
-- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
-
-
-## 5) Privacy, Logging, Analytics
-
-**CRITICAL:**
-- PII in logs (`name`, `phone`, `location`, identifiers)
-- Tokens/headers in logs
-- Crashlytics sending PII
-
-**Guidance:**
-- Redact: Authorization headers, cookies, IDs if sensitive
-- Provide `toSafeLog()` helpers
-- Ensure debug logging is disabled/limited in release builds
-
-
-## 6) Dependency & Supply Chain Hygiene
-
-- [ ] Check new packages are reputable and maintained
-- [ ] Avoid adding packages that request broad permissions without need
-- [ ] Pin versions as appropriate; review changelogs for security fixes
-
-
-## 7) Security Review Checklist for PRs
-
-### Always Search For
-- `print(`, `debugPrint(`, logging interceptors
-- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
-- `badCertificateCallback`, `HttpClient` overrides
-- Persistent storage of user/session data
-
-### Enforce
-- [ ] No secrets in repo
-- [ ] No insecure network overrides in production
-- [ ] Logout clears sensitive local data
-- [ ] Access control enforced server-side (don't trust client role/org headers alone)
-
-
-## Quick Reference
-
-### Secure Storage (DO)
-
-```dart
-// ✅ Use flutter_secure_storage for tokens
-final storage = FlutterSecureStorage();
-await storage.write(key: 'auth_token', value: token);
-```
-
-### Secure Storage (DON'T)
-
-```dart
-// ❌ Never store tokens in SharedPreferences
-final prefs = await SharedPreferences.getInstance();
-prefs.setString('auth_token', token); // INSECURE!
-
-// ❌ Never hardcode secrets
-const apiKey = 'sk_live_abc123'; // NEVER DO THIS
-```
-
-### Log Redaction
-
-```dart
-// ❌ Bad - logs sensitive data
-logger.info('User login: ${user.email}, password: ${password}');
-
-// ✅ Good - no sensitive data in logs
-logger.info('User login successful: userId=${user.id}');
-```
-
-
-## Steering Files
-
-| File                        | Load When                              |
-| --------------------------- | -------------------------------------- |
-| `secure_storage_policy.md`  | What to store where                    |
-| `network_hardening.md`      | Network security best practices        |
-| `log_redaction.md`          | How to redact sensitive data from logs |
-| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
-| `secret-scanning.md`        | Finding hardcoded secrets              |
-
-## Templates
-
-- `security_review_response.md` - Security review report template

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/flutter-security-reviewer/references/log_redaction.md

@@ -1,17 +0,0 @@
-# Logging redaction policy
-
-## Never log
-- Authorization headers
-- Cookies
-- refresh/access tokens
-- passwords/OTP codes
-- full request/response bodies containing PII
-
-## Recommended
-- Log request method + path + status code
-- Log timing and correlation ids
-- Redact sensitive fields:
-
-Example (pseudo):
-- headers: replace Authorization with "***"
-- body: replace keys like token/password with "***"

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/flutter-security-reviewer/references/network_hardening.md

@@ -1,13 +0,0 @@
-# Network hardening (Dio)
-
-Checklist:
-- HTTPS only for UAT/Prod
-- Timeouts configured
-- Interceptors do not leak sensitive info
-- No `badCertificateCallback` in release
-- Use request IDs/transaction hashes for tracing (non-secret)
-
-Retry policy:
-- idempotent requests only (GET)
-- exponential backoff
-- cap attempts

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/flutter-security-reviewer/references/secret-scanning.md

@@ -1,123 +0,0 @@
-# Secret Scanning
-
-> Reference for: Security Reviewer
-> Load when: Scanning for hardcoded secrets
-
-## Manual Grep Patterns
-
-```bash
-# Common secret patterns
-grep -rn "api_key\|apikey\|api-key" --include="*.dart" .
-grep -rn "secret\|password\|passwd" --include="*.dart" .
-grep -rn "private_key\|privatekey" --include="*.dart" .
-grep -rn "access_token\|accesstoken" --include="*.dart" .
-
-# Firebase/Google
-grep -rn "AIza[0-9A-Za-z_-]{35}" .
-grep -rn "firebase" --include="*.dart" .
-
-# AWS credentials
-grep -rn "AKIA[0-9A-Z]{16}" .
-grep -rn "aws_secret_access_key" .
-
-# Base64 encoded (potential secrets)
-grep -rn "[A-Za-z0-9+/]{40,}=" .
-
-# JWT tokens
-grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .
-```
-
-## Common Secret Patterns
-
-| Type              | Pattern                          | Example                    |
-| ----------------- | -------------------------------- | -------------------------- |
-| AWS Access Key    | `AKIA[0-9A-Z]{16}`               | AKIAIOSFODNN7EXAMPLE       |
-| AWS Secret Key    | 40 char base64                   | wJalrXUtnFEMI/K7MDENG...   |
-| Firebase API Key  | `AIza[0-9A-Za-z_-]{35}`          | AIzaSyC...                 |
-| GitHub Token      | `ghp_[A-Za-z0-9]{36}`            | ghp_xxxxxxxxxxxx           |
-| Slack Token       | `xox[baprs]-`                    | xoxb-xxx-xxx               |
-| Stripe Key        | `sk_live_[A-Za-z0-9]{24}`        | sk_live_xxxx               |
-| Private Key       | `-----BEGIN.*PRIVATE KEY-----`  | RSA/EC keys                |
-| JWT               | `eyJ[A-Za-z0-9_-]*\.eyJ`         | Encoded tokens             |
-
-## Flutter-Specific Locations to Check
-
-```bash
-# Check these files for hardcoded secrets
-lib/core/config/
-lib/firebase_options.dart
-android/app/google-services.json
-ios/Runner/GoogleService-Info.plist
-.env files
-pubspec.yaml (sometimes contains keys)
-```
-
-## What to Look For
-
-### Hardcoded API Keys
-```dart
-// BAD - Hardcoded
-const apiKey = 'sk_live_abc123xyz';
-const firebaseKey = 'AIzaSyC...';
-
-// GOOD - Environment variable or secure storage
-final apiKey = const String.fromEnvironment('API_KEY');
-final apiKey = await secureStorage.read(key: 'api_key');
-```
-
-### Hardcoded URLs with Credentials
-```dart
-// BAD
-const dbUrl = 'postgres://user:password@host:5432/db';
-
-// GOOD
-final dbUrl = const String.fromEnvironment('DATABASE_URL');
-```
-
-### Debug/Test Credentials
-```dart
-// BAD - Test credentials in production code
-const testUser = 'admin';
-const testPassword = 'admin123';
-
-// GOOD - Only in test files, never committed
-// Use environment variables or test fixtures
-```
-
-## Remediation Steps
-
-1. **Rotate immediately** - Consider secret compromised
-2. **Remove from code** - Replace with environment variable
-3. **Remove from git history** - Use BFG or git filter-branch
-4. **Add to .gitignore** - Prevent future commits
-5. **Use secure storage** - flutter_secure_storage for runtime secrets
-6. **Use --dart-define** - For build-time configuration
-
-```bash
-# Build with environment variables
-flutter build apk --dart-define=API_KEY=$API_KEY
-
-# Access in code
-const apiKey = String.fromEnvironment('API_KEY');
-```
-
-## Pre-commit Prevention
-
-```yaml
-# .pre-commit-config.yaml
-repos:
-  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.18.0
-    hooks:
-      - id: gitleaks
-```
-
-## Quick Reference
-
-| Location                    | Risk Level | Action                      |
-| --------------------------- | ---------- | --------------------------- |
-| Source code (.dart)         | Critical   | Remove, use env vars        |
-| Config files                | High       | Move to .gitignore          |
-| Git history                 | Critical   | Rewrite history             |
-| Build artifacts             | Medium     | Ensure not committed        |
-| Comments/TODOs              | Medium     | Remove sensitive info       |

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/flutter-security-reviewer/references/secure_storage_policy.md

@@ -1,16 +0,0 @@
-# Secure storage policy (mobile)
-
-## Token storage
-Preferred:
-- Platform-backed secure storage for auth tokens
-
-If you must use SharedPreferences:
-- access tokens should be short-lived
-- never store refresh token unless encrypted/secured
-- clear all tokens on logout
-- guard against backup/restore exposures where relevant
-
-## Cached user/profile data
-- Apply TTL
-- Avoid caching sensitive PII unless required for offline
-- Clear per-organization/user on logout or org switch