reis-mobile 0.3.5

package/skills/flutter-use-http-package/SKILL.md

@@ -0,0 +1,178 @@
+---
+name: flutter-use-http-package
+description: Use the `http` package to execute GET, POST, PUT, or DELETE requests. Use when you need to fetch from or send data to a REST API.
+metadata:
+  model: models/gemini-3.1-pro-preview
+  last_modified: Tue, 21 Apr 2026 21:36:42 GMT
+routing: manual
+stacks: [flutter]
+source: https://github.com/flutter/skills
+license: BSD-3-Clause
+---
+# Implementing Flutter Networking
+
+## Contents
+- [Configuration & Permissions](#configuration--permissions)
+- [Request Execution & Response Handling](#request-execution--response-handling)
+- [Background Parsing](#background-parsing)
+- [Workflow: Executing Network Operations](#workflow-executing-network-operations)
+- [Examples](#examples)
+
+## Configuration & Permissions
+
+Configure the environment and platform-specific permissions required for network access.
+
+1. Add the `http` package dependency via the terminal:
+   ```bash
+   flutter pub add http
+   ```
+2. Import the package in your Dart files:
+   ```dart
+   import 'package:http/http.dart' as http;
+   ```
+3. Configure Android permissions by adding the Internet permission to `android/app/src/main/AndroidManifest.xml`:
+   ```xml
+   <uses-permission android:name="android.permission.INTERNET" />
+   ```
+4. Configure macOS entitlements by adding the network client key to both `macos/Runner/DebugProfile.entitlements` and `macos/Runner/Release.entitlements`:
+   ```xml
+   <key>com.apple.security.network.client</key>
+   <true/>
+   ```
+
+## Request Execution & Response Handling
+
+Execute HTTP operations and map responses to strongly typed Dart objects.
+
+*   **URIs:** Always parse URL strings using `Uri.parse('your_url')`.
+*   **Headers:** Inject authorization and content-type headers via the `headers` parameter map. Use `HttpHeaders.authorizationHeader` for auth tokens.
+*   **Payloads:** For POST and PUT requests, encode the body using `jsonEncode()` from `dart:convert`.
+*   **Status Validation:** Evaluate `response.statusCode`. Treat `200 OK` (GET/PUT/DELETE) and `201 CREATED` (POST) as success. 
+*   **Error Handling:** Throw explicit exceptions for non-success status codes. Never return `null` on failure, as this prevents `FutureBuilder` from triggering its error state and causes infinite loading indicators.
+*   **Deserialization:** Parse the raw string using `jsonDecode(response.body)` and map it to a custom Dart object using a factory constructor (e.g., `fromJson`).
+
+## Background Parsing
+
+Offload expensive JSON parsing to a separate Isolate to prevent UI jank (frame drops).
+
+*   Import `package:flutter/foundation.dart`.
+*   Use the `compute()` function to run the parsing logic in a background isolate.
+*   Ensure the parsing function passed to `compute()` is a top-level function or a static method, as closures or instance methods cannot be passed across isolates.
+
+## Workflow: Executing Network Operations
+
+Use the following checklist to implement and validate network operations.
+
+**Task Progress:**
+- [ ] 1. Define the strongly typed Dart model with a `fromJson` factory constructor.
+- [ ] 2. Implement the network request method returning a `Future<Model>`.
+- [ ] 3. Apply conditional logic based on the operation type:
+  - **If fetching data (GET):** Append query parameters to the URI.
+  - **If mutating data (POST/PUT):** Set `'Content-Type': 'application/json; charset=UTF-8'` and attach the `jsonEncode` body.
+  - **If deleting data (DELETE):** Return an empty model instance on success (`200 OK`).
+- [ ] 4. Validate the `statusCode` and throw an `Exception` on failure.
+- [ ] 5. Integrate the `Future` into the UI using `FutureBuilder`.
+- [ ] 6. Handle `snapshot.hasData`, `snapshot.hasError`, and default to a `CircularProgressIndicator`.
+- [ ] 7. **Feedback Loop:** Run the app -> trigger the network request -> review console for unhandled exceptions -> fix parsing or permission errors.
+
+## Examples
+
+### High-Fidelity Implementation: Fetching and Parsing in the Background
+
+```dart
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+import 'package:flutter/foundation.dart';
+import 'package:flutter/material.dart';
+import 'package:http/http.dart' as http;
+
+// 1. Top-level parsing function for Isolate
+List<Photo> parsePhotos(String responseBody) {
+  final parsed = (jsonDecode(responseBody) as List<Object?>)
+      .cast<Map<String, Object?>>();
+  return parsed.map<Photo>(Photo.fromJson).toList();
+}
+
+// 2. Network execution with background parsing
+Future<List<Photo>> fetchPhotos() async {
+  final response = await http.get(
+    Uri.parse('https://jsonplaceholder.typicode.com/photos'),
+    headers: {
+      HttpHeaders.authorizationHeader: 'Bearer your_token_here',
+      HttpHeaders.acceptHeader: 'application/json',
+    },
+  );
+
+  if (response.statusCode == 200) {
+    // Offload heavy parsing to a background isolate
+    return compute(parsePhotos, response.body);
+  } else {
+    throw Exception('Failed to load photos. Status: ${response.statusCode}');
+  }
+}
+
+// 3. Strongly typed model
+class Photo {
+  final int id;
+  final String title;
+  final String thumbnailUrl;
+
+  const Photo({
+    required this.id,
+    required this.title,
+    required this.thumbnailUrl,
+  });
+
+  factory Photo.fromJson(Map<String, dynamic> json) {
+    return Photo(
+      id: json['id'] as int,
+      title: json['title'] as String,
+      thumbnailUrl: json['thumbnailUrl'] as String,
+    );
+  }
+}
+
+// 4. UI Integration
+class PhotoGallery extends StatefulWidget {
+  const PhotoGallery({super.key});
+
+  @override
+  State<PhotoGallery> createState() => _PhotoGalleryState();
+}
+
+class _PhotoGalleryState extends State<PhotoGallery> {
+  late Future<List<Photo>> _futurePhotos;
+
+  @override
+  void initState() {
+    super.initState();
+    // Initialize Future once to prevent re-fetching on rebuilds
+    _futurePhotos = fetchPhotos();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return FutureBuilder<List<Photo>>(
+      future: _futurePhotos,
+      builder: (context, snapshot) {
+        if (snapshot.hasData) {
+          final photos = snapshot.data!;
+          return ListView.builder(
+            itemCount: photos.length,
+            itemBuilder: (context, index) => ListTile(
+              leading: Image.network(photos[index].thumbnailUrl),
+              title: Text(photos[index].title),
+            ),
+          );
+        } else if (snapshot.hasError) {
+          return Center(child: Text('Error: ${snapshot.error}'));
+        }
+        
+        // Default loading state
+        return const Center(child: CircularProgressIndicator());
+      },
+    );
+  }
+}
+```

package/skills/flutter-widget-review/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: flutter-widget-review
+description: Reviews Flutter widget code for lifecycle bugs, BuildContext misuse across async gaps, missing dispose, side effects in build, unnecessary rebuilds, list and image performance, layout overflow risks and accessibility. Use when reviewing Dart files under lib/ that contain widgets, screens or pages, or when the user asks to review Flutter UI code.
+intents: [review, performance]
+stacks: [flutter]
+---
+
+# Flutter Widget Review
+
+Apply to Dart files with widgets (`StatelessWidget`, `StatefulWidget`, `ConsumerWidget`, `HookWidget`...). Items are ordered by impact: the first ones cause crashes or visible bugs.
+
+## 1. Lifecycle and async (crash / bug)
+
+- [ ] **`BuildContext` after `await`.** Using `context` (`Navigator.of`, `ScaffoldMessenger.of`, `Theme.of`) after an `await` without checking `if (!context.mounted) return;` (or `mounted` in a `State`). The `use_build_context_synchronously` lint covers some of the cases.
+- [ ] **`setState` after `dispose`.** `Future`, `Stream` or `Timer` callbacks that call `setState` without checking `mounted`.
+- [ ] **Resources without `dispose`.** `TextEditingController`, `AnimationController`, `ScrollController`, `PageController`, `FocusNode`, `StreamSubscription`, `Timer` and `ChangeNotifier` created in the `State` must be released in `dispose()`.
+- [ ] **Controller created inside `build`.** Recreates the controller on every rebuild and loses state (typed text, scroll position).
+- [ ] **`Future` created inside `build`.** `FutureBuilder(future: api.fetch())` repeats the request on every rebuild. The `Future` should be created in `initState`, in the state management layer or memoized.
+- [ ] **Side effects in `build`.** Navigation, `showDialog`, analytics or network calls inside `build`. They belong in listeners (`BlocListener`, `ref.listen`) or in `addPostFrameCallback`.
+
+## 2. State and identity
+
+- [ ] Reorderable or removable list items without a stable `Key` (`ValueKey(item.id)`): state ends up on the wrong item.
+- [ ] `GlobalKey` created inside `build`.
+- [ ] Business state kept in a `StatefulWidget` when the project already uses a state manager.
+
+## 3. Rendering performance
+
+- [ ] Missing `const` constructors in static subtrees (only report in widgets that rebuild often).
+- [ ] Long lists with `ListView(children: [...])` / `Column` inside `SingleChildScrollView`: use `ListView.builder` or `SliverList`.
+- [ ] `shrinkWrap: true` on a large list inside another scroll view: forces layout of every item.
+- [ ] Rebuild scope too large: `setState`, `BlocBuilder` or `Consumer` at the top of the screen when only one part changes. Use `buildWhen`, `select` or extract the widget.
+- [ ] `MediaQuery.of(context)` used only for the size: `MediaQuery.sizeOf(context)` rebuilds less. Confirm the Flutter version in `pubspec.lock` before suggesting it.
+- [ ] Network images without `cacheWidth`/`cacheHeight` or without caching, decoded at full resolution to display thumbnails.
+- [ ] Animated `Opacity` or `ClipRRect`/`BackdropFilter` in list items: prefer `FadeTransition`/`AnimatedOpacity` and avoid unnecessary clipping.
+- [ ] Heavy work (parsing large JSON, cryptography, image processing) on the UI thread: use `compute`/`Isolate.run`.
+
+## 4. Layout
+
+- [ ] `Row` with `Text` without `Expanded`/`Flexible`: overflow with long text or a larger system font.
+- [ ] Fixed height or width for text content: breaks with a high `textScaler`.
+- [ ] Missing `SafeArea` on screens without `Scaffold`/`AppBar`.
+- [ ] Keyboard covering fields: form outside a scroll view.
+
+## 5. Accessibility and i18n
+
+- [ ] `IconButton` and `GestureDetector` without `tooltip` or `Semantics(label: ...)`.
+- [ ] Touch target smaller than 48x48 dp.
+- [ ] Hardcoded visible strings when the project already uses `intl`/`AppLocalizations`.
+- [ ] Information conveyed by color alone.
+
+## Output
+
+Report in the appropriate section of the report (Bugs for section 1, Performance for section 3...), always with `file:line` and the corrected snippet when the fix is short.

package/skills/flutter-working-with-databases/SKILL.md

@@ -0,0 +1,203 @@
+---
+name: flutter-working-with-databases
+description: Manages local data persistence using SQLite or other database solutions. Use when a Flutter app needs to store, query, or synchronize large amounts of structured data on the device.
+metadata:
+  model: models/gemini-3.1-pro-preview
+  last_modified: Thu, 12 Mar 2026 22:19:15 GMT
+routing: manual
+stacks: [flutter]
+source: https://github.com/flutter/skills
+license: BSD-3-Clause
+---
+# Architecting the Data Layer
+
+## Contents
+- [Core Architecture](#core-architecture)
+- [Services Implementation](#services-implementation)
+- [Repository Implementation](#repository-implementation)
+- [Caching Strategies](#caching-strategies)
+- [Workflows](#workflows)
+- [Examples](#examples)
+
+## Core Architecture
+
+Construct the data layer as the Single Source of Truth (SSOT) for all application data. In an MVVM architecture, the data layer represents the Model. Never update application data outside of this layer. 
+
+Separate the data layer into two distinct components: **Repositories** and **Services**.
+
+### Repositories
+*   Act as the SSOT for a specific domain entity.
+*   Contain business logic for data mutation, polling, caching, and offline synchronization.
+*   Transform raw data models (API/DB models) into Domain Models (clean data classes containing only what the UI needs).
+*   Inject Services as private members to prevent the UI layer from bypassing the repository.
+
+### Services
+*   Act as stateless wrappers around external data sources (HTTP clients, SQLite databases, platform plugins).
+*   Perform no business logic or data transformation beyond basic JSON serialization.
+*   Return raw data models or `Result` wrappers to the calling repository.
+
+## Services Implementation
+
+### Database Services (SQLite)
+Use databases to persist and query large amounts of structured data locally. 
+*   Add `sqflite` and `path` packages to `pubspec.yaml`.
+*   Use the `path` package to define the storage location on disk safely across platforms.
+*   Define table schemas using constants to prevent typos.
+*   Use `id` as the primary key with `AUTOINCREMENT` to improve query and update times.
+*   Always use `whereArgs` in SQL queries to prevent SQL injection (e.g., `where: 'id = ?', whereArgs: [id]`).
+
+### API Services
+*   Wrap HTTP calls (e.g., using the `http` package) in dedicated client classes.
+*   Return asynchronous response objects (`Future` or `Stream`).
+*   Handle raw JSON serialization at this level, returning API-specific data models.
+
+## Repository Implementation
+
+### Domain Models
+*   Define immutable data classes (using `freezed` or `built_value`) for Domain Models.
+*   Strip out backend-specific fields (like metadata or pagination tokens) that the UI does not need.
+
+### Offline-First Synchronization
+Combine local and remote data sources within the repository to provide seamless offline support.
+
+*   **If reading data:** Return a `Stream` that immediately yields the cached local data from the Database Service, performs the network request via the API Service, updates the Database Service, and then yields the fresh data.
+*   **If writing data (Online-only):** Attempt the API Service mutation first. If successful, update the Database Service.
+*   **If writing data (Offline-first):** Update the Database Service immediately. Attempt the API Service mutation. If the network fails, flag the local database record as `synchronized: false` and queue a background synchronization task.
+
+## Caching Strategies
+
+Select the appropriate caching strategy based on the data payload:
+*   **Small Key-Value Data:** Use `shared_preferences` for simple app configurations, theme settings, or user preferences.
+*   **Large Datasets:** Use relational (`sqflite`, `drift`) or non-relational (`hive_ce`, `isar_community`) on-device databases.
+*   **Images:** Use the `cached_network_image` package to automatically cache remote images to the device's file system.
+*   **API Responses:** Implement lightweight remote caching within the API Service or Repository using in-memory maps or temporary file storage.
+
+## Workflows
+
+### Workflow: Implementing a New Data Feature
+Copy and track this checklist when adding a new data entity to the application.
+
+- [ ] **Task Progress**
+  - [ ] Define the Domain Model (immutable, UI-focused).
+  - [ ] Define the API/DB Models (raw data structures).
+  - [ ] Create or update the Service(s) to handle raw data fetching/storage.
+  - [ ] Create the Repository interface (abstract class).
+  - [ ] Implement the Repository, injecting the required Service(s) as private dependencies.
+  - [ ] Map raw Service models to the Domain Model within the Repository.
+  - [ ] Expose Repository methods to the View Model.
+  - [ ] Run validator -> review errors -> fix.
+
+### Workflow: Implementing SQLite Persistence
+Follow this sequence to add a new SQLite table and integrate it.
+
+- [ ] **Task Progress**
+  - [ ] Add `sqflite` and `path` dependencies.
+  - [ ] Define table name and column constants.
+  - [ ] Update the `onCreate` or `onUpgrade` method in the Database Service to execute the `CREATE TABLE` statement.
+  - [ ] Implement `insert`, `query`, `update`, and `delete` methods in the Database Service.
+  - [ ] Inject the Database Service into the target Repository.
+  - [ ] Ensure the Repository calls `database.open()` before executing queries.
+
+## Examples
+
+### Offline-First Repository Implementation
+This example demonstrates a Repository coordinating between a Database Service and an API Service using a Stream for offline-first reads.
+
+```dart
+import 'dart:async';
+
+class TodoRepository {
+  TodoRepository({
+    required DatabaseService databaseService,
+    required ApiClientService apiClientService,
+  })  : _databaseService = databaseService,
+        _apiClientService = apiClientService;
+
+  final DatabaseService _databaseService;
+  final ApiClientService _apiClientService;
+
+  /// Yields local data immediately, then fetches remote data, updates local, and yields fresh data.
+  Stream<List<Todo>> observeTodos() async* {
+    // 1. Yield local cached data first
+    final localTodos = await _databaseService.getAllTodos();
+    if (localTodos.isNotEmpty) {
+      yield localTodos.map((model) => Todo.fromDbModel(model)).toList();
+    }
+
+    try {
+      // 2. Fetch fresh data from API
+      final remoteTodos = await _apiClientService.fetchTodos();
+      
+      // 3. Update local database
+      await _databaseService.replaceAllTodos(remoteTodos);
+      
+      // 4. Yield fresh data
+      yield remoteTodos.map((model) => Todo.fromApiModel(model)).toList();
+    } on Exception catch (e) {
+      // Handle network errors (UI will still have local data)
+      // Log error or yield a specific error state if required
+    }
+  }
+
+  /// Offline-first write: Save locally, then attempt remote sync.
+  Future<void> createTodo(Todo todo) async {
+    final dbModel = todo.toDbModel().copyWith(isSynced: false);
+    
+    // 1. Save locally immediately
+    await _databaseService.insertTodo(dbModel);
+
+    try {
+      // 2. Attempt remote sync
+      final apiModel = await _apiClientService.postTodo(todo.toApiModel());
+      
+      // 3. Mark as synced locally
+      await _databaseService.updateTodo(
+        dbModel.copyWith(id: apiModel.id, isSynced: true)
+      );
+    } on Exception catch (_) {
+      // Leave as isSynced: false for background sync task to pick up later
+    }
+  }
+}
+```
+
+### SQLite Database Service Implementation
+Demonstrates safe query construction using `whereArgs`.
+
+```dart
+class DatabaseService {
+  static const String _tableName = 'todos';
+  static const String _colId = 'id';
+  static const String _colTask = 'task';
+  static const String _colIsSynced = 'is_synced';
+
+  Database? _database;
+
+  Future<void> open() async {
+    if (_database != null) return;
+    
+    final dbPath = join(await getDatabasesPath(), 'app_database.db');
+    _database = await openDatabase(
+      dbPath,
+      version: 1,
+      onCreate: (db, version) {
+        return db.execute(
+          'CREATE TABLE $_tableName('
+          '$_colId INTEGER PRIMARY KEY AUTOINCREMENT, '
+          '$_colTask TEXT, '
+          '$_colIsSynced INTEGER)'
+        );
+      },
+    );
+  }
+
+  Future<void> updateTodo(TodoDbModel todo) async {
+    await _database!.update(
+      _tableName,
+      todo.toMap(),
+      where: '$_colId = ?',
+      whereArgs: [todo.id], // Prevents SQL injection
+    );
+  }
+}
+```

package/skills/flutterfire-configure/SKILL.md

@@ -0,0 +1,143 @@
+---
+name: flutterfire-configure
+description: Sets up Firebase for Flutter apps using FlutterFire CLI. Use when initializing a Firebase project, running flutterfire configure, initializing Firebase in main.dart, or configuring multiple app flavors.
+routing: manual
+stacks: [flutter]
+source: https://github.com/evanca/flutter-ai-rules
+license: MIT
+---
+
+# FlutterFire Configure Skill
+
+This skill defines how to correctly set up and configure Firebase for Flutter applications.
+
+## When to Use
+
+Use this skill when:
+
+* Adding Firebase to a Flutter project for the first time.
+* Running `flutterfire configure` after adding a new Firebase service or platform.
+* Initializing Firebase in `main.dart`.
+* Setting up separate Firebase projects for multiple app flavors.
+
+---
+
+## 1. Prerequisites
+
+Install the required tools:
+
+```bash
+npm install -g firebase-tools
+firebase login
+dart pub global activate flutterfire_cli
+```
+
+**Minimum platform requirements:**
+- Android: API level 19 (KitKat) or higher
+- Apple: iOS 11 or higher
+
+---
+
+## 2. Setup and Configuration
+
+```bash
+# From your Flutter project directory:
+flutterfire configure
+
+# Add the core Firebase package:
+flutter pub add firebase_core
+```
+
+- Re-run `flutterfire configure` any time you **add support for a new platform** or **start using a new Firebase service**.
+- For Android-specific services (Crashlytics, Performance Monitoring), the FlutterFire CLI automatically adds the required Gradle plugins.
+- Rebuild with `flutter run` after adding new Firebase plugins.
+
+---
+
+## 3. Firebase Initialization
+
+```dart
+import 'package:firebase_core/firebase_core.dart';
+import 'firebase_options.dart';
+
+void main() async {
+  WidgetsFlutterBinding.ensureInitialized();
+  await Firebase.initializeApp(
+    options: DefaultFirebaseOptions.currentPlatform,
+  );
+  runApp(const MyApp());
+}
+```
+
+- Call `WidgetsFlutterBinding.ensureInitialized()` **before** Firebase initialization.
+- Place Firebase initialization **before** any other Firebase service calls.
+- **Never modify** `firebase_options.dart` manually — it is auto-generated.
+- **Commit** `firebase_options.dart` to version control — it contains non-secret configuration identifiers.
+- For Firebase Emulator Suite: `await Firebase.initializeApp(demoProjectId: "demo-project-id")`.
+
+---
+
+## 4. Best Practices
+
+- Enable **Firebase Analytics** for optimal experience with Crashlytics, Remote Config, and other products.
+- Use a **consistent Firebase project** across all platforms for data consistency.
+- For iOS/macOS apps using certain Firebase services, add the **Keychain Sharing** capability in Xcode.
+- Test your Firebase configuration with **both debug and release** builds.
+- Check **version compatibility** between Flutter plugins and the underlying Firebase SDK.
+
+---
+
+## 5. Multiple App Flavors
+
+Create separate Firebase projects per environment (development, staging, production):
+
+```bash
+flutterfire config \
+  --project=flutter-app-dev \
+  --out=lib/firebase_options_dev.dart \
+  --ios-bundle-id=com.example.flutterApp.dev \
+  --ios-out=ios/flavors/dev/GoogleService-Info.plist \
+  --android-package-name=com.example.flutter_app.dev \
+  --android-out=android/app/src/dev/google-services.json
+```
+
+**Centralize Firebase initialization by flavor:**
+
+```dart
+// firebase.dart
+import 'package:firebase_core/firebase_core.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_app/firebase_options_prod.dart' as prod;
+import 'package:flutter_app/firebase_options_stg.dart' as stg;
+import 'package:flutter_app/firebase_options_dev.dart' as dev;
+
+Future<void> initializeFirebaseApp() async {
+  final firebaseOptions = switch (appFlavor) {
+    'prod' => prod.DefaultFirebaseOptions.currentPlatform,
+    'stg' => stg.DefaultFirebaseOptions.currentPlatform,
+    'dev' => dev.DefaultFirebaseOptions.currentPlatform,
+    _ => throw UnsupportedError('Invalid flavor: $appFlavor'),
+  };
+  await Firebase.initializeApp(options: firebaseOptions);
+}
+```
+
+```dart
+// main.dart
+void main() async {
+  WidgetsFlutterBinding.ensureInitialized();
+  await initializeFirebaseApp();
+  runApp(const MainApp());
+}
+```
+
+- Use `appFlavor` or environment variables to select the configuration at runtime.
+- Import each flavor's config with **namespace aliases** (e.g., `as dev`).
+- Use a helper script to automate multi-flavor configuration.
+
+---
+
+## References
+
+- [Add Firebase to your Flutter app](https://firebase.google.com/docs/flutter/setup)
+- [FlutterFire CLI](https://firebase.flutter.dev/docs/cli)

package/skills/mobile-security-audit/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: mobile-security-audit
+description: Security audit for mobile apps based on the OWASP MASVS categories — insecure token storage, hardcoded secrets, cleartext traffic, TLS validation bypass, exported components, WebView exposure, sensitive logging and release hardening — with concrete checks for Flutter, Android, iOS and React Native. Use when reviewing mobile code, auditing app security, handling authentication or tokens, or preparing a release.
+intents: [review, security, release]
+stacks: ["*"]
+---
+
+# Mobile Security Audit
+
+Organized by the OWASP MASVS categories. Apply the general section and then the one for the detected stack (in cross-platform apps, also apply Android and iOS to the native folders).
+
+Every finding needs evidence in the code or configuration. Severity:
+
+- **Critical:** exposed credential or sensitive data, TLS validation disabled, exported component that performs a privileged action.
+- **High:** token in insecure storage, cleartext traffic to the API, WebView with a JavaScript bridge exposed to remote content.
+- **Medium/Low:** missing hardening, verbose logs, backup enabled without need.
+
+## General (all stacks)
+
+**MASVS-STORAGE**
+- [ ] Access token, refresh token and personal data kept in insecure storage (preferences, files, unencrypted database).
+- [ ] Sensitive data in logs, analytics or crash reports.
+
+**MASVS-CRYPTO**
+- [ ] Private API keys, client secrets, signing keys or passwords in source code, assets or bundled configuration files. Everything shipped in the app can be extracted; a real secret stays on the backend.
+- [ ] Homemade cryptography, fixed IV/key, MD5/SHA-1 for passwords.
+
+**MASVS-AUTH**
+- [ ] Authorization decided only on the client (local `isAdmin` flag, hiding a button as access control).
+- [ ] Session without expiration or refresh token never invalidated on logout.
+- [ ] Biometrics used only as a local boolean, without binding to a cryptographic key.
+
+**MASVS-NETWORK**
+- [ ] `http://` URLs for APIs.
+- [ ] Certificate validation disabled.
+- [ ] Pinning, if present, without a rotation strategy (single pin with no backup).
+
+**MASVS-PLATFORM**
+- [ ] Deep links and universal links that perform actions without validating parameters or without authentication.
+- [ ] WebView loading remote content with JavaScript and a native bridge enabled.
+- [ ] Sensitive data on the clipboard or visible in the app switcher snapshot.
+
+**MASVS-CODE / RESILIENCE**
+- [ ] Release build without obfuscation/minification when the app has sensitive logic.
+- [ ] Debug code or endpoints reachable in release.
+
+**MASVS-PRIVACY**
+- [ ] Permissions requested without real use in the code.
+- [ ] Third-party SDKs collecting undeclared data (Privacy Manifest on iOS, Data safety on the Play Store).
+
+## Flutter
+
+- [ ] Tokens in `shared_preferences`, `hive` or `sqflite` without encryption: use `flutter_secure_storage` (Keychain/Keystore).
+- [ ] `HttpClient.badCertificateCallback` returning `true` or `HttpOverrides.global` disabling validation: Critical if it reaches the release build.
+- [ ] `print`/`debugPrint`/`log` with a token, `Authorization` header or login payload. `dio` interceptors with `LogInterceptor` active in release.
+- [ ] Secrets passed via `--dart-define` and treated as safe: they end up in the binary.
+- [ ] Release build without `--obfuscate --split-debug-info` when the app needs obfuscation.
+- [ ] `webview_flutter` with `JavaScriptMode.unrestricted` and `addJavaScriptChannel` loading an uncontrolled URL.
+
+## Android (Kotlin/Java, or `android/` in cross-platform apps)
+
+- [ ] `AndroidManifest.xml`: `android:usesCleartextTraffic="true"` or `network_security_config` with `cleartextTrafficPermitted="true"` for production domains.
+- [ ] `network_security_config` trusting user certificates (`<certificates src="user"/>`) in release.
+- [ ] `android:allowBackup="true"` (or absent) in an app with sensitive data, without exclusion rules.
+- [ ] `activity`/`service`/`receiver`/`provider` with `android:exported="true"` without a permission and without validating the `Intent`.
+- [ ] `android:debuggable="true"` hardcoded in the manifest.
+- [ ] Tokens in `SharedPreferences` without encryption.
+- [ ] `WebView` with `setJavaScriptEnabled(true)` + `addJavascriptInterface` or `setAllowFileAccess(true)`.
+- [ ] Custom `TrustManager`/`HostnameVerifier` that accepts everything.
+- [ ] `Log.d`/`Log.v` with sensitive data not stripped in release (R8 rules or a log wrapper).
+- [ ] Keystore passwords in a committed `build.gradle` instead of `key.properties`/environment variables.
+
+## iOS (Swift/Objective-C, or `ios/` in cross-platform apps)
+
+- [ ] `Info.plist`: `NSAppTransportSecurity` with `NSAllowsArbitraryLoads = true` without a justified per-domain exception.
+- [ ] Tokens in `UserDefaults` or files instead of the Keychain.
+- [ ] Keychain items with permissive accessibility (`kSecAttrAccessibleAlways*`, already deprecated) instead of `...WhenUnlocked`/`...AfterFirstUnlock`.
+- [ ] `URLSessionDelegate` accepting any `serverTrust` without evaluating it.
+- [ ] Custom URL schemes performing actions without validation (prefer universal links).
+- [ ] `NSLog`/`print` with sensitive data.
+- [ ] Screen with sensitive data without snapshot protection when going to background.
+
+## React Native
+
+- [ ] Tokens in `AsyncStorage`: use Keychain/Keystore (`react-native-keychain`, `expo-secure-store`).
+- [ ] `.env` via `react-native-config`/`expo-constants` with secrets: they go into the JS bundle, readable in the APK/IPA.
+- [ ] `react-native-webview` with `originWhitelist={['*']}` and `onMessage` performing actions.
+- [ ] `console.log` with sensitive data not stripped in release (for example, `babel-plugin-transform-remove-console`).
+- [ ] Deep links handled in `Linking` without validating origin and parameters.
+
+## Useful commands (read-only)
+
+```bash
+git ls-files | grep -Ei '\.(jks|keystore|p12|p8|mobileprovision|env)$|key\.properties|google-services\.json|GoogleService-Info\.plist'
+grep -rn --include='*.xml' -E 'usesCleartextTraffic|allowBackup|exported="true"|debuggable' android app 2>/dev/null
+grep -rn -E 'NSAllowsArbitraryLoads' --include='*.plist' . 2>/dev/null
+```
+
+## Output
+
+Report under **Security** (or **Critical**, when the severity is Critical), with the MASVS category, `file:line`, impact and fix.