Dart and Flutter rules
Snyk Code security rules for Dart and Flutter
Each rule includes the following information.
Rule Name: The Snyk name of the rule.
CWEs: The CWE numbers the rule covers.
Security Categories: The OWASP Top 10 (2025 edition) category the rule maps to, when applicable. This column also notes whether the rule appears in the CWE Top 25, and any applicable OWASP API Security Top 10 (2023) or OWASP Mobile Top 10 (2024) categories.
Clear Text Logging
CWE-200, CWE-312
CWE Top 25, OWASP:A01:2025, OWASP:A06:2025, OWASP-API:API10:2023
Cleartext Transmission - HTTP Instead of HTTPS
CWE-319
OWASP:A04:2025, OWASP-API:API8:2023, OWASP-API:API10:2023
Code Injection
CWE-94
CWE Top 25, OWASP:A05:2025
File Access Enabled
CWE-200
CWE Top 25, OWASP:A01:2025, OWASP-API:API10:2023
Improper Certificate Validation - SSL Verification Bypass
CWE-295
OWASP:A07:2025
Insecure JWT Verification Method
CWE-347
OWASP:A04:2025
Insecure Storage Shared Keystore
CWE-922
OWASP:A01:2025
Insecure Token Storage
CWE-798
OWASP:A07:2025
Sensitive Cookie Without 'HttpOnly' Flag
CWE-1004
OWASP:A02:2025
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-614
OWASP:A02:2025
Use of Hardcoded Credentials
CWE-798
OWASP:A07:2025
Use of Hardcoded Cryptographic Key
CWE-321
OWASP:A04:2025
Use of Insufficiently Random Values - Secrets
CWE-330
OWASP:A04:2025
Use of Password Hash With Insufficient Computational Effort
CWE-916
OWASP:A04:2025
Use of a Broken or Risky Cryptographic Algorithm
CWE-327
OWASP:A04:2025
Last updated
Was this helpful?