Security Audit

Security Audit Guide

OWASP Mobile Top 10 Checklist

Legend: ✅ = Implemented and verified | 🔍 = Requires periodic audit

PII Audit Commands

Find Potential PII in Code

grep -rn "phone\|email\|password\|token\|secret\|key" lib/ --include="*.dart" | grep -v "test\|mock\|example"

Find Logging of PII

grep -rn "log\|print\|debug" lib/ --include="*.dart" | grep -i "phone\|email\|token"

Find Hardcoded Secrets

grep -rn "AIza\|firebase\|api[_-]key\|secret\|password" . --include="*.dart" --include="*.ts" --include="*.json" | grep -v node_modules

PII Classification

GDPR Compliance Matrix

Data Retention

• Active accounts: Data retained while account is active.
• Deleted accounts: All PII removed within 30 days. Aggregated/anonymized data may be retained.
• Logs: Rotated every 30 days on device; Crashlytics retains for 90 days.
• Backups: Firestore PITR (Point-in-Time Recovery) retains for 7 days.

Account Deletion Flow

The deleteAccount Cloud Function must:

1. Delete users/{uid} document
2. Remove user from all groups/{gid}/members/{uid}
3. Delete userGroups/{uid} and all subcollections
4. Delete userFriends/{uid} and all subcollections
5. Delete user from all friends/{fid} where user is a participant
6. Delete all notifications/{nid} for user
7. Delete all drafts/{did} for user
8. Revoke all active sessions via Firebase Auth
9. Delete Firebase Auth account
10. Log deletion event (without PII) for audit trail

Firestore Security Rules Audit

Key:

• self = request.auth.uid == userId
• member = user exists in groups/{gid}/members
• admin+ = member with role admin or owner
• pair = user is one of the two users in the friend pair
• CF only = Cloud Functions service account only (deny client writes)
• soft only = set isDeleted: true instead of actual deletion

Security Scan Commands

Dependency Audit

# Dart/Flutter dependencies
dart pub audit

# Cloud Functions dependencies
cd functions && npm audit

Secret Scanning

# Scan for leaked secrets in git history
gitleaks detect --source . --verbose

# Quick check for common patterns
grep -rn "AKIA\|AIza\|sk_live\|sk_test\|-----BEGIN" . --include="*.dart" --include="*.ts" --include="*.json" --include="*.yaml" | grep -v node_modules | grep -v ".pub-cache"

Debug Code in Release

# Find debug-only code that should not ship
grep -rn "kDebugMode\|assert(" lib/ --include="*.dart"

# Find print statements (should use AppLogger instead)
grep -rn "print(" lib/ --include="*.dart" | grep -v "// ignore: avoid_print"

# Find TODO/FIXME that may be security-related
grep -rn "TODO\|FIXME\|HACK\|XXX" lib/ --include="*.dart" | grep -i "secur\|auth\|token\|pii\|encrypt"

Build Hardening Verification

# Verify obfuscation is enabled in release builds
grep -rn "obfuscate\|split-debug-info\|proguard" android/app/build.gradle pubspec.yaml Makefile

# Verify no debug flags in release config
grep -rn "debugShowCheckedModeBanner\|debugPrint" lib/ --include="*.dart"

Security Review Checklist for PRs

• No PII logged (phone, email, name, token)
• No hardcoded secrets or API keys
• Firestore security rules updated if new collection/field added
• Input validation on all user-provided data
• Error messages don't leak internal details to users
• New dependencies audited (dart pub audit)
• Amounts validated as non-negative integers (paise)
• No raw print() statements (use AppLogger)
• Sensitive data in flutter_secure_storage, not SharedPreferences

Converted and distributed by TomeVault — claim your Tome and manage your conversions.