Security Audit Report

Audit Overview

Published

📅 Audit date: 2026-06-01📄 Scope: all 159 .dart files in lib/ · 14 .html plugins in plugins/ · android/ config🔬 Method: cross-file verification + bottom-up layered audit

Critical

High

Medium

Low

Confirmed safe

Overall: the project's security posture is sound. Core mechanisms are properly implemented: Hive sensitive-data encryption, sandbox isolation, enforced HTTPS. Main issues center on Android build-machine key management, a few Hive boxes outside the encryption scope, and password input in the plugin layer.

🔧

Fix progress since publication: later releases have already fixed multiple issues — API keys now stored per-vendor in encrypted buckets (v1.7.0), password manager fake encryption rewritten as real AES-256-GCM (v1.7.0), 2FA persistence (v1.7.0), strict SSL certificate verification in the network toolbox (v1.7.0), clipboard sensitive-field filtering (v1.7.0), automatic re-encryption when changing the master password (v1.1.0). Latest fixes: see the changelog.

Confirmed Real Issues

🔴 Critical

Critical

#1 Android signing key password stored in plaintext — the signing key passphrase sits in plaintext in the build machine's config; compromising the build machine equals compromising the signing key.

🟠 High

High

#2 ai_plugin_projects Box stores aiApiKey unencrypted — project-level AI keys are persisted in plaintext in Hive, outside the encryption scope.

High

#3 Hardcoded test license key in the plugin market — test credentials should not ship in release builds.

High

#4 REQUEST_INSTALL_PACKAGES permission — the app requests permission to install apps from unknown sources; the use case should be minimized.

🟡 Medium

Medium

#5 Baidu Translate API key transmitted via GET URL parameter — the key may leak into access logs / history.

Medium

#6 Plugins input encryption passwords via prompt() — password entry inside the sandbox should use the host's secure keyboard channel.

Medium

#7 WebDAV auto-backup password stored in Hive — must confirm it is inside an encrypted box.

Medium

#8 RECORD_AUDIO permission — should be requested on demand only for recording, not granted persistently.

🟢 Low

Low

#9 sticky_notes Box stores user notes unencrypted

Low

#10 Ledger plugin stores financial data in plaintext

Low

#11 requestLegacyExternalStorage compat flag — should be removed as targetSdk upgrades

Low

#12 Bookmark plugin allows http:// URLs — plaintext pages should default to a downgrade warning

Low

#13 Error log export may expose internal paths — stack traces contain file paths and code structure

⚪ Suspected Issues (need manual confirmation)

Suspected

S1 Widespread innerHTML usage in plugins (13/14 plugins) — most already escape via escapeHtml(), and the sandbox CSP restricts external scripts, but any missed escaping is a potential DOM XSS.

Suspected

S2 console.log / console.error calls in plugins — output goes to logcat; contents are error objects without user data, low risk.

Confirmed Safe Designs

The following mechanisms passed cross-file verification and are confirmed safe and effective:

#	Mechanism	Verification path	Status
1	Hive encryption key hardware protection	`FlutterSecureStorage` → Android Keystore / iOS Keychain	✓
2	7/7 sensitive Boxes encrypted	cross-checked in main.dart; sensitive boxes all opened with cipher	✓
3	Backups forcibly encrypted	no password → `UnencryptedBackupException`	✓
4	Backup encryption algorithm	PBKDF2 (300k rounds) + AES-256-GCM	✓
5	Zero logging overhead in release	all log output inside `kDebugMode`	✓
6	WebDAV HTTPS enforced	HTTP configurations rejected outright	✓
7	Sandbox eval / Function disabled	full Object.defineProperty coverage	✓
8	Sandbox CSP injection	meta tag + HTTP header dual path	✓
9	Path traversal protection	security checks on plugin import and backup restore	✓
10	Other confirmed items	backup cipher v3, atomic restore flow, FLAG_SECURE on sensitive pages, etc.	✓

🔬

The full report (with per-item code locations and fix suggestions) will be published with the open-source repository. This is the condensed version. Security is our foundation — any findings are welcome via feedback.