Cicada

🔐 Cicada — Security Audit & Fix Skill

Command: /cicada
Audit your backend and mobile apps for vulnerabilities — and optionally fix them — without deploying or breaking anything.

Compatible with: CODEX, CLAUDE, OPENCODE, Cursor, Windsurf, any LLM coding agent.
Covers: Node.js, Python, Go, Ruby, PHP, Java, .NET + Express, Next.js, NestJS, Django, Flask, FastAPI, Gin, Rails, Laravel, Spring Boot + Flutter, React Native.

How to Invoke

You:  /cicada
Agent:  Choose mode:
        1 → Report only (no code changes)
        2 → Interactive fix (ask per finding)
        3 → Auto-fix all (fix everything, confirm once)

You:  /cicada audit my backend
Agent:  (loads SKILL.md, asks mode, runs audit)

You:  security audit
Agent:  (triggered by AGENTS.md, loads SKILL.md, asks mode)

Tool-specific setup

When to Load

Load this skill when the user says:

• /cicada — primary command
• "security audit / security review / vulnerability scan"
• "check for vulnerabilities / find security issues"
• "is my app secure / are my auth flows safe"
• "audit login / password reset / connectors / API keys"
• "OWASP review / pentest my code / HackerOne style review"
• "is this production-ready from a security perspective"
• "fix security issues / patch vulnerabilities"
• "audit my Flutter app / React Native app"

Operation Mode

The LLM must ask the user which mode they want before proceeding.

┌──────────────────────────────────────────────────────────┐
│ Choose mode:                                             │
│                                                          │
│  1 → Report only (no code changes)                       │
│  2 → Interactive fix (ask per finding)                   │
│  3 → Auto-fix all (fix everything, confirm once)         │
│                                                          │
│ Enter 1, 2, or 3:                                        │
└──────────────────────────────────────────────────────────┘

Audit Scope

Check Methodology

1. Detect framework(s) used (see Framework Detection below).
2. Search the codebase for relevant patterns (grep, glob).
3. Read surrounding context (20–40 lines) to understand the implementation.
4. Assess severity using the rubric at the end of this document.
5. Log every finding — even low-severity — into an internal findings list.
6. If mode 2 or 3: apply the fix template associated with each finding.

Framework Detection

Before running checks, auto-detect every framework present. Read config files and key source imports. Then run only the relevant sections below.

Detection Table

Run ALL relevant sections based on detected frameworks. If multiple frameworks are detected (e.g., Next.js backend + Flutter mobile), run checks for all of them.

7. Web Framework Security

Run this section for every detected web framework in addition to the universal checks (sections 1–6).

7.1 Node.js / Express

Search:  package.json, express, app.use(, router.get(, router.post(

• Missing Helmet — is helmet() applied globally? Without it, default security headers (CSP, HSTS, X-Frame-Options) are absent.
• CORS misconfigured — cors({ origin: '*' }) in production? Should use an allowlist.
• Rate limiting missing — is express-rate-limit applied to auth routes?
• Body parser size limit — does express.json({ limit: '10mb' }) have an unbounded limit? Set to '1mb' or '10kb' for small payloads.
• HTTP parameter pollution — does the app handle duplicate query params safely? (e.g., ?id=1&id=2)
• Prototype pollution — are there any unsafe lodash.merge, Object.assign(req.body, ...), or for...in patterns?
• Cookie config — are cookies missing httpOnly, secure, sameSite?
• Express app.set('trust proxy') — is it configured correctly behind a reverse proxy? If not, rate limiting may see all traffic from 127.0.0.1.
• Directory listing — is express.static configured without dotfiles: 'deny'? Can attackers list directories?

Fix: Add Helmet + rate limiting + secure cookies

const helmet = require('helmet');
const rateLimit = require('express-rate-limit');

app.use(helmet());
app.use(express.json({ limit: '1mb' }));

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many attempts'
});
app.post('/login', authLimiter, loginHandler);

app.use(require('cookie-parser')());
app.use((req, res, next) => {
  res.cookie('session', req.sessionID, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 24 * 60 * 60 * 1000
  });
  next();
});

7.2 Next.js

Search:  package.json, next.config, middleware.ts, pages/api/, app/api/

• Server Actions CSRF — are Next.js Server Actions protected with CSRF tokens? (Next.js 14+ has built-in CSRF for Server Actions — verify it's not disabled.)
• Middleware bypass — does middleware.ts protect all sensitive routes? Check for missing matcher config.
• API route exposure — are internal API routes behind authentication middleware? Check pages/api/ or app/api/ for unprotected handlers.
• getServerSideProps data leakage — does getServerSideProps pass sensitive data (tokens, DB records) to the client without filtering?
• next/image SSRF — are remote image URLs user-controllable without a host allowlist? (CVE-2023-34247)
• next.config.js exposure — is publicRuntimeConfig leaking secrets to the client bundle?
• Incremental Static Regeneration (ISR) — are secret revalidation URLs predictable or unprotected?
• App Router: useSearchParams XSS — are search params rendered without sanitization in client components?
• next/script CSP bypass — are external scripts loaded with strategy: 'beforeInteractive' bypassing CSP?

Fix: Secure middleware

// middleware.ts
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const token = request.cookies.get('session')?.value;
  const isAuthPage = request.nextUrl.pathname.startsWith('/login');

  if (!token && !isAuthPage) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: ['/dashboard/:path*', '/api/protected/:path*']
};

Fix: Image SSRF protection

// next.config.js
module.exports = {
  images: {
    remotePatterns: [
      { protocol: 'https', hostname: 'cdn.example.com' },
      { protocol: 'https', hostname: 'images.example.com' }
    ]
  }
};

7.3 NestJS

Search:  package.json, @nestjs, @UseGuards, @Controller, GraphQLModule

• Missing @UseGuards — are controllers/routes missing authentication guards? Check for public endpoints that should be protected.
• DTO validation bypass — are DTOs missing class-validator decorators? (@IsEmail(), @IsString(), @MinLength(8))
• GraphQL introspection enabled in production — is introspection: true set in GraphQLModule.forRoot()? (Leaks entire schema.)
• @Serialize / class-serializer exposure — does @Serialize expose sensitive fields like password, ssn?
• Rate limiting missing — is @nestjs/throttler configured globally?
• CORS misconfigured — is cors: true / origin: '*' in NestFactory.create()?
• File upload validation — are file uploads unrestricted in size or type?
• Validation pipe global — is app.useGlobalPipes(new ValidationPipe()) applied? (Without it, DTO validation is opt-in per route.)

Fix: Global validation + throttling

import { NestFactory } from '@nestjs/core';
import { ValidationPipe } from '@nestjs/common';
import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  app.enableCors({
    origin: process.env.CORS_ORIGIN?.split(',') || 'http://localhost:3000',
    credentials: true
  });

  app.useGlobalPipes(new ValidationPipe({
    whitelist: true,
    forbidNonWhitelisted: true,
    transform: true
  }));

  await app.listen(3000);
}

// app.module.ts
@Module({
  imports: [
    ThrottlerModule.forRoot([{
      ttl: 60000,
      limit: 100
    }])
  ],
  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }]
})

7.4 Python / Django

Search:  settings.py, manage.py, requirements.txt, SECRET_KEY, DEBUG, ALLOWED_HOSTS

• SECRET_KEY hardcoded or committed — is the Django SECRET_KEY in settings.py instead of an env var?
• DEBUG = True in production — is DEBUG set to True in production settings? (Leaks stack traces, settings, queries.)
• ALLOWED_HOSTS misconfigured — is ['*'] used? (Permits host header injection.)
• SQL injection via .raw() / extra() — are raw SQL queries parameterized?
• Mass assignment — are Django REST Framework serializers using fields = '__all__' without read-only fields?
• mark_safe() / safe filter XSS — is mark_safe() used on user input in templates?
• CSRF middleware missing — is CsrfViewMiddleware in MIDDLEWARE settings?
• Session cookie config — are SESSION_COOKIE_HTTPONLY, SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE set?
• File upload validation — is FILE_UPLOAD_MAX_MEMORY_SIZE set? Are uploaded file types validated?
• Django REST Framework throttle — is DEFAULT_THROTTLE_CLASSES configured for auth endpoints?
• CORS headers — is django-cors-headers configured with a specific CORS_ALLOWED_ORIGINS, not CORS_ALLOW_ALL_ORIGINS = True?
• Admin panel exposure — is django.contrib.admin accessible at /admin/ without IP restriction or VPN?

Fix: Secure settings.py

import os

SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
DEBUG = os.environ.get('DJANGO_DEBUG', 'False') == 'False'
ALLOWED_HOSTS = os.environ.get('DJANGO_ALLOWED_HOSTS', '.example.com').split(',')

SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
CSRF_COOKIE_HTTPONLY = True
SECURE_HSTS_SECONDS = 63072000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_SSL_REDIRECT = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER = True
X_FRAME_OPTIONS = 'DENY'

# Rate limiting
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '100/hour',
        'user': '1000/hour'
    }
}

7.5 Python / Flask

Search:  app.py, config.py, requirements.txt, Flask(__name__), secret_key, debug=True

• secret_key hardcoded — is app.secret_key set to a static string in source?
• debug=True in production — does app.run(debug=True) exist? (Leaves the Werkzeug debugger and console open — RCE via debugger PIN.)
• Jinja2 SSTI (Server-Side Template Injection) — is render_template_string() used with user input?
• Missing CSRF protection — is Flask-WTF or flask-seasurf installed and enabled?
• Session cookies — are SESSION_COOKIE_HTTPONLY, SESSION_COOKIE_SECURE, SESSION_COOKIE_SAMESITE configured?
• CORS wildcard — is flask-cors configured with origins='*'?
• Rate limiting — is flask-limiter applied to auth routes?

Fix: Secure Flask app

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
from flask_talisman import Talisman

app = Flask(__name__)
app.secret_key = os.environ['FLASK_SECRET_KEY']
app.config.update(
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_SAMESITE='Lax'
)

# Security headers
Talisman(app, content_security_policy={
    'default-src': "'self'",
    'script-src': "'self'"
})

# Rate limiting
limiter = Limiter(
    get_remote_address,
    app=app,
    default_limits=["200 per day", "50 per hour"]
)

# 🚫 NEVER: app.run(debug=True)

7.6 Python / FastAPI

Search:  main.py, requirements.txt, FastAPI(), CORSMiddleware, @app.get

• CORS wildcard — is CORSMiddleware configured with allow_origins=["*"]?
• Missing authentication — are routes missing Depends(get_current_user)?
• Pydantic validation bypass — are request models missing Pydantic validators? (Field(..., min_length=8))
• GraphQL introspection — if using Strawberry/Ariadne, is introspection disabled in production?
• File upload size — are file uploads missing max_size on UploadFile?
• Rate limiting — is slowapi or fastapi-limiter configured?
• OpenAPI / Swagger exposure — is /docs or /redoc exposed in production? (Leaks full API structure.)
• Server info leakage — does uvicorn run with --header Server: uvicorn? Attackers can target known uvicorn bugs.

Fix: Secure FastAPI

from fastapi import FastAPI, Depends, HTTPException
from fastapi.middleware.cors import CORSMiddleware
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

app = FastAPI(
    docs_url=None,          # Disable Swagger in production
    redoc_url=None,         # Disable ReDoc in production
    servers=[{"url": "https://api.example.com"}]
)

app.state.limiter = limiter
app.add_exception_handler(429, _rate_limit_exceeded_handler)

app.add_middleware(
    CORSMiddleware,
    allow_origins=os.environ.get('CORS_ORIGINS', '').split(','),
    allow_credentials=True,
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
)

@app.get("/users/me")
@limiter.limit("30/minute")
async def read_users_me(current_user=Depends(get_current_user)):
    return current_user

7.7 Go / Gin

Search:  go.mod, main.go, gin.Default(), router.GET(, c.Query(, db.Query(

• CORS wildcard — is gin-contrib/cors configured with AllowAllOrigins: true?
• Missing recovery middleware — is gin.Recovery() included? (Without it, panics crash the server.)
• No rate limiting — is gin-limiter or similar applied to auth routes?
• Raw SQL injection — are there db.Query(fmt.Sprintf(...)) calls with user input?
• No TrustedPlatform — is gin.TrustedPlatform set behind a reverse proxy? (Without it, client IP detection may be wrong for rate limiting.)
• Verbose error responses — does the API return raw error messages or stack traces?
• Cookie config — are session cookies missing HttpOnly, Secure, SameSite?
• No request size limit — is c.MaxMultipartMemory and gin.MaxMultipartMemory configured?

Fix: Secure Gin

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/gin-contrib/cors"
    "golang.org/x/time/rate"
)

func main() {
    r := gin.New()
    r.Use(gin.Recovery())
    r.Use(gin.Logger())

    // CORS
    r.Use(cors.New(cors.Config{
        AllowOrigins: []string{"https://app.example.com"},
        AllowCredentials: true,
        AllowMethods: []string{"GET", "POST", "PUT", "DELETE"},
        AllowHeaders: []string{"Authorization", "Content-Type"},
    }))

    // Rate limiting
    limiter := rate.NewLimiter(rate.Limit(10), 20)
    r.Use(func(c *gin.Context) {
        if !limiter.Allow() {
            c.AbortWithStatusJSON(429, gin.H{"error": "Too many requests"})
            return
        }
        c.Next()
    })

    r.GET("/login", loginHandler)
    r.Run(":3000")
}

7.8 Ruby on Rails

Search:  Gemfile, config/application.rb, config/secrets.yml, app/controllers/

• secret_key_base hardcoded or weak — is secret_key_base in config/secrets.yml or credentials.yml.enc exposed?
• config.force_ssl = false — is HTTPS not enforced?
• Mass assignment — are there params.permit! calls that allow all attributes? (CVE-2012-2660, CVE-2012-2695)
• Render inline SSTI — is render inline: used with user input? (Server-Side Template Injection.)
• attr_accessible / attr_protected bypass — are sensitive model attributes protected from mass assignment?
• SQL injection via where() strings — are there Model.where("name = '#{params[:name]}'") calls?
• Missing CSRF token — is protect_from_forgery with: :exception in ApplicationController?
• Open redirect — are there unsafe redirect_to params[:url] patterns? (CVE-2023-23913)
• N+1 queries exposed — does the JSON API leak child records without authorization checks?
• Cookie config — are cookies missing httponly, secure, samesite in config/initializers/session_store.rb?

Fix: Secure Rails configuration

# config/application.rb
config.force_ssl = true
config.ssl_options = { redirect: { status: 301 } }

# config/initializers/session_store.rb
Rails.application.config.session_store :cookie_store, {
  key: '_app_session',
  httponly: true,
  secure: Rails.env.production?,
  same_site: :strict,
  expire_after: 24.hours
}

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception

  before_action :sanitize_redirect
  private
  def sanitize_redirect
    redirect_url = params[:url]
    if redirect_url.present? && !redirect_url.start_with?('/')
      redirect_to root_path, alert: 'Invalid redirect'
    end
  end
end

7.9 PHP / Laravel

Search:  composer.json, .env, config/app.php, routes/web.php, routes/api.php

• APP_KEY exposed — is APP_KEY in .env committed to the repo?
• APP_DEBUG=true in production — is debug mode enabled? (Leaks full stack traces and env vars.)
• Mass assignment — are Eloquent models missing $fillable or using $guarded = []?
• SQL injection via whereRaw / DB::raw — are raw queries using string interpolation with user input?
• Blade XSS — is {!! $var !!} (unescaped Blade output) used with user-controlled content?
• Missing CSRF — is @csrf excluded from forms? Is VerifyCsrfToken middleware removed?
• CORS misconfigured — is laravel-cors set to 'allowed_origins' => ['*']?
• Rate limiting — is throttle middleware applied to auth routes? (Route::post('login', ...)->middleware('throttle:5,60'))
• Session config — are sessions configured with http_only => true, secure => true?
• Debug bar in production — is barryvdh/laravel-debugbar installed and visible?
• Artisan console exposure — is routes/console.php exposing sensitive commands?

Fix: Secure Laravel

// .env (ensure in .gitignore!)
APP_KEY=base64:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
APP_DEBUG=false
APP_URL=https://example.com

DB_CONNECTION=mysql
DB_HOST=${DB_HOST}
DB_DATABASE=${DB_DATABASE}
DB_USERNAME=${DB_USERNAME}
DB_PASSWORD=${DB_PASSWORD}

// config/session.php
'http_only' => true,
'secure' => env('APP_ENV') === 'production',
'same_site' => 'strict',

// routes/api.php
Route::post('/login', [AuthController::class, 'login'])
    ->middleware(['throttle:5,60']);

7.10 Java / Spring Boot

Search:  pom.xml, build.gradle, application.properties, application.yml, @RestController, @RequestMapping

• Actuator endpoints exposed — are /actuator, /actuator/env, /actuator/heapdump accessible without authentication? (Leaks env vars — including AWS keys, DB passwords.)
• @CrossOrigin(origins = "*") — are any controllers using wildcard CORS?
• @PathVariable injection — are path variables used in SQL queries without parameterization?
• H2 console in production — is spring.h2.console.enabled=true set? (Database admin panel with no auth.)
• Default Actuator ports — is Actuator on the same port as the app? Should be on a separate, firewalled port.
• No CSRF protection — is Spring Security CSRF protection disabled? (http.csrf().disable())
• Verbose error responses — is server.error.include-stacktrace=always set? (Leaks internal paths and framework details.)
• Unvalidated file uploads — is spring.servlet.multipart.max-file-size unset or too large?
• Spring Boot DevTools in production — is spring-boot-devtools on the classpath? (Remote restart and debug endpoints.)
• Sensitive fields in JSON — are @JsonIgnore annotations missing on password, secret, token fields?

Fix: Secure application.properties

# Disable actuator in production or secure it
management.endpoints.web.exposure.exclude=*
management.endpoint.health.show-details=never

# Disable H2 console
spring.h2.console.enabled=false

# Limit file uploads
spring.servlet.multipart.max-file-size=10MB
spring.servlet.multipart.max-request-size=10MB

# No stack traces
server.error.include-stacktrace=never
server.error.include-message=never

# Force HTTPS
server.ssl.enabled=true

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .csrf(csrf -> csrf.requireCsrfProtectionMatcher(...))
            .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .anyRequest().authenticated()
            );
        return http.build();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOrigins(List.of("https://app.example.com"));
        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
        config.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", config);
        return source;
    }
}

8. Mobile App Security

Run this section when the project contains Flutter (pubspec.yaml) or React Native (package.json with react-native).

8.1 Flutter / Dart

Search:  pubspec.yaml, android/app/src/main/AndroidManifest.xml, ios/Runner/Info.plist, lib/

• API keys hardcoded in Dart — are API keys, Firebase configs, or tokens hardcoded in Dart source? (Dart code decompiles easily with dart2js / flutter build apk --release + dex2jar.)
• Insecure local storage — is sensitive data stored in SharedPreferences instead of flutter_secure_storage? (SharedPreferences is plaintext on disk.)
• No SSL pinning — is HTTP client created without certificate pinning? (http.Client() vs pinned dio or http_secure?)
• Deep link hijacking — are Android App Links / iOS Universal Links configured? Or does the app use custom URL schemes (e.g., myapp://) that any app can register?
• WebView XSS / JS bridge — does webview_flutter have javascriptMode: JavascriptMode.unrestricted? Does JavaScriptChannel expose sensitive native APIs?
• obscureText: false on password fields — are password TextFields missing obscureText: true?
• Sensitive logging — is debugPrint() or print() used for sensitive data? (Release builds can still have debug logging.)
• Android: Allow cleartext traffic — is android:usesCleartextTraffic="true" in AndroidManifest.xml?
• iOS: ATS bypass — is NSAllowsArbitraryLoads = true in Info.plist? (Disables App Transport Security.)
• Root / jailbreak detection — is there any root detection? If not, attackers can modify the app binary and extract secrets.
• Code obfuscation — was the app built without --obfuscate and --split-debug-info? (Without obfuscation, Dart code retains class/method names.)
• Firebase config files — are google-services.json (Android) or GoogleService-Info.plist (iOS) readable and restricted to the intended app? (These contain API keys.)
• Biometric auth — if using biometrics, is the secret stored with KeyStore / Keychain integration (via local_auth + flutter_secure_storage)?
• Android: Exported components — are Activity, Service, or BroadcastReceiver exported without permission? (android:exported="true" without intent filters.)
• iOS: Keychain accessibility — is kSecAttrAccessible set to kSecAttrAccessibleWhenUnlockedThisDeviceOnly for sensitive data?

Fix: Secure storage + SSL pinning (Flutter)

// 🚫 BAD:
final prefs = await SharedPreferences.getInstance();
await prefs.setString('auth_token', token);

// ✅ GOOD:
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

const storage = FlutterSecureStorage();
await storage.write(key: 'auth_token', value: token);

// 🚫 BAD:
final response = await http.get(Uri.parse('https://api.example.com/data'));

// ✅ GOOD — SSL pinning with Dio
import 'package:dio/dio.dart';

final dio = Dio(BaseOptions(
  baseUrl: 'https://api.example.com',
  connectTimeout: const Duration(seconds: 10),
));

(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate =
    (client) {
  client.badCertificateCallback = (cert, host, port) => false; // reject all
  return client;
};

Fix: Secure Android manifest

<!-- AndroidManifest.xml -->
<application
    android:usesCleartextTraffic="false"
    android:allowBackup="false"
    android:networkSecurityConfig="@xml/network_security_config">

    <!-- Only export if required -->
    <activity
        android:name=".MainActivity"
        android:exported="false" />
</application>

<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">api.example.com</domain>
    </domain-config>
</network-security-config>

Fix: iOS ATS configuration

<!-- Info.plist -->
<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <false/>
    <key>NSExceptionDomains</key>
    <dict>
        <key>api.example.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
    </dict>
</dict>

Fix: Build with obfuscation

flutter build apk --obfuscate --split-debug-info=build/debug-info/
flutter build ios --obfuscate --split-debug-info=build/debug-info/

8.2 React Native

Search:  package.json, android/app/src/main/AndroidManifest.xml, ios/Info.plist, app.json

• API keys in .env or hardcoded — are API keys in react-native-config .env files committed? Are they hardcoded in JS source? (JS bundle is unencrypted on device.)
• AsyncStorage for sensitive data — is AsyncStorage used for tokens, secrets, or PII? (AsyncStorage is unencrypted plaintext — use react-native-keychain or expo-secure-store.)
• No SSL pinning — does fetch() or axios connect without certificate validation? (Use react-native-ssl-pinning or axios with httpsAgent.)
• Deep link hijacking — are Android App Links / iOS Universal Links properly configured, or does a custom URL scheme (myapp://) allow any app to intercept?
• WebView vulnerabilities — does react-native-webview have allowFileAccess={true}, allowUniversalAccessFromFileURLs={true}, or javaScriptEnabled={true} without a content allowlist?
• secureTextEntry: false on password fields — are password TextInputs missing secureTextEntry={true}?
• console.log in production — are console.log, console.warn, console.error statements present in production code? (They can leak data to logs accessible by other apps on device.)
• Android: Allow cleartext traffic — is android:usesCleartextTraffic="true" in AndroidManifest.xml?
• iOS: ATS bypass — is NSAllowsArbitraryLoads = true in Info.plist?
• Firebase / Google Services — are google-services.json or GoogleService-Info.plist committed with unrestricted API keys?
• Code obfuscation — is Hermes enabled without obfuscation? (JS bundle can be reverse-engineered with react-native-decompiler.)
• React Native Debugger enabled — is __DEV__ mode exposed in production? (Debugger allows arbitrary JS execution.)
• Flipper / Metro bundler in production — is react-native-flipper or Metro bundler enabled in release builds? (Exposes debugging endpoints.)
• Android: Exported activities — are Activitys exported without permission?
• iOS: Keychain accessibility — is react-native-keychain configured with accessControl: ACCESS_CONTROL.BIOMETRY_CURRENT_SET_OR_DEVICE_PASSCODE?
• Clipboard exposure — is sensitive data (passwords, tokens) accessible via the system clipboard? (Other apps can read the clipboard on Android.)
• Bundle ID / Package name spoofing — does the app validate its own bundle identifier at runtime? (Without it, a malicious clone with the same bundle ID can steal keychain data.)

Fix: Secure storage (React Native)

// 🚫 BAD:
import AsyncStorage from '@react-native-async-storage/async-storage';
await AsyncStorage.setItem('auth_token', token);

// ✅ GOOD:
import * as Keychain from 'react-native-keychain';

await Keychain.setInternetCredentials(
  'api.example.com', // server
  'user',            // username
  token,             // password (stores token securely)
  {
    accessControl: Keychain.ACCESS_CONTROL.BIOMETRY_CURRENT_SET_OR_DEVICE_PASSCODE,
    accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY
  }
);

Fix: SSL pinning (React Native)

// 🚫 BAD:
const response = await fetch('https://api.example.com/data');

// ✅ GOOD (with react-native-ssl-pinning):
import { fetch } from 'react-native-ssl-pinning';

const response = await fetch('https://api.example.com/data', {
  method: 'GET',
  sslPinning: {
    certs: ['certificate_name'] // bundled .cer files
  },
  timeoutInterval: 10000
});

Fix: Secure WebView configuration

// 🚫 BAD:
<WebView
  source={{ uri: 'https://example.com' }}
  javaScriptEnabled={true}
  allowFileAccess={true}
/>

// ✅ GOOD:
<WebView
  source={{ uri: 'https://example.com' }}
  javaScriptEnabled={true}
  allowFileAccess={false}
  allowUniversalAccessFromFileURLs={false}
  allowFileAccessFromFileURLs={false}
  mixedContentMode="never"
  => {
    // Only accept messages if origin is trusted
    if (event.nativeEvent.url.startsWith('https://example.com')) {
      handleMessage(event.nativeEvent.data);
    }
  }}
/>

Fix: Android manifest hardening

<!-- AndroidManifest.xml -->
<application
    android:usesCleartextTraffic="false"
    android:allowBackup="false"
    android:networkSecurityConfig="@xml/network_security_config">

    <activity
        android:name=".MainActivity"
        android:exported="false"
        android:windowSoftInputMode="adjustResize">

        <!-- Deep links: use verified App Links -->
        <intent-filter android:autoVerify="true">
            <action android:name="android.intent.action.VIEW" />
            <category android:name="android.intent.category.DEFAULT" />
            <category android:name="android.intent.category.BROWSABLE" />
            <data android:scheme="https" android:host="app.example.com" />
        </intent-filter>
    </activity>
</application>

Fix: Remove debug logs in production

// At app entry point (index.ts)
if (!__DEV__) {
  global.console.log = () => {};
  global.console.warn = () => {};
  global.console.error = () => {};
  // Keep global.console.error for crash reporting if needed
}

9. Cloud & Infrastructure Security

Search:  Dockerfile, docker-compose, kubernetes, deploy, aws, gcp, azure, s3, bucket, iam, role, policy

9.1 Container Security (Docker / K8s)

• Root user in container — does Dockerfile use USER nobody or USER 1000? Running as root inside a container allows escape on container break-out.
• Unpinned base images — are base images pinned to a digest (alpine:latest@sha256:...) or a patch version? (FROM node:18 vs FROM node:18.17.1-slim)
• Secrets in Dockerfile — are ENV or ARG directives used for secrets? (They persist in image layers.)
• .dockerignore missing — is there a .dockerignore? Without it, .env and secrets may be copied into the image.
• K8s: Pod security context — do pods have runAsNonRoot: true, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true?
• K8s: RBAC over-permissive — do service accounts have cluster-admin or wildcard resource access?
• K8s: Secrets not encrypted — are Secrets used without encryption at rest? (K8s Secrets are base64 only by default.)
• K8s: No network policy — is there a NetworkPolicy restricting pod-to-pod traffic? (Default is allow-all.)
• K8s: Host network / host PID — are pods using hostNetwork: true or hostPID: true? (Escapes container isolation.)

Fix: Secure Dockerfile

FROM node:18-slim@sha256:abc123def456

# Create non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser

WORKDIR /app
COPY --chown=appuser:appuser package*.json ./
RUN npm ci --only=production

COPY --chown=appuser:appuser . .
USER appuser

EXPOSE 3000
CMD ["node", "server.js"]

# .dockerignore
.env
.env.local
node_modules
.git
*.md
tests/

Fix: K8s pod security context

apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
  containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]

9.2 Cloud Provider Configuration

• S3 bucket public access — are there any S3 buckets with public-read or public-read-write ACLs? (Data exposure.)
• S3 bucket block public access — is BlockPublicAccess enabled at account or bucket level?
• IAM wildcard policies — do IAM policies use "Effect": "Allow", "Action": "*" or "Resource": "*" unnecessarily?
• IAM keys not rotated — are there IAM access keys older than 90 days?
• Cloud storage bucket encryption — is server-side encryption (SSE-S3, SSE-KMS) enabled on storage buckets?
• Cloud function public invocation — are cloud functions (AWS Lambda, GCP Cloud Functions) invocable without authentication?
• Managed DB publicly accessible — are RDS, Cloud SQL, or Cosmos DB instances publicly accessible with a password alone?
• Security group / firewall rules — are there security group rules with 0.0.0.0/0 for SSH (22), RDP (3389), or database ports?
• TLS termination — is TLS terminated at the load balancer with a valid certificate, or are backends handling raw HTTP?
• CloudTrail / Audit Logs — is CloudTrail (AWS), Audit Logs (GCP), or equivalent enabled for the account?
• Default VPC — is the default VPC in use with open egress? Should use a custom VPC with restricted egress.

Fix: S3 bucket hardening

# Terraform: Block public access
resource "aws_s3_bucket_public_access_block" "example" {
  bucket                  = aws_s3_bucket.example.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# IAM least privilege
resource "aws_iam_policy" "restricted" {
  policy = jsonencode({
   

…(truncated)