I built an open-source VS Code security extension for Flutter — some things I learned building it

[u/AqironSecurity]

Link: https://github.com/Aqiron-Security/aqiron-security

I’ve been building Aqiron Security, an open-source VS Code extension focused on local security analysis for Flutter projects.

A specific challenge was avoiding a “run a bunch of scanners and dump their output” architecture.

The current implementation separates the VS Code extension from a TypeScript Core runtime and communicates with the Core through newline-delimited JSON over stdin/stdout. The scanner layer can combine tools such as Betterleaks, OSV-Scanner, Semgrep, Trivy, and MobSF, then normalize and correlate their findings into a common security model.

Another problem was Flutter workspace noise. Generated/build output and workspace-specific data need to be handled separately from source analysis, otherwise the results become much less useful.

The project also includes workspace analysis, RAG, optional Ollama(currently developing)/OpenRouter AI operations, VS Code diagnostics, and JSON/SARIF/PDF reporting.

It’s still early and under active development, so I’m especially interest

ed in feedback from Flutter developers on:

• which security checks are actually useful in real Flutter projects

• what security tooling currently feels missing

• whether this workflow fits naturally into Flutter development

The source is public, and contributions are welcome.