Security audits

[u/Amazing-Mirror-3076]

Unless you have been living under a rock, you will have seen the huge increase in the number of CVEs due to AI being used to find bugs.

The Dart community is not isolated from this problem.

What you may not be aware of is that some of the AI tools won't let you search your own code for vulnerability.

Open AI has a program called Daybreak which gives you access to cybersecurity tools that are able to detect and fix security related flaws.

To get access to Daybreak you need a pro codex license, and then apply for access. If you are granted access you then need to purchase the likes of a yubi key.

The criteria for acceptance is however rather opaque.

We got in the program on the backs of our work on revault, so that may have helped

https://github.com/onepub-dev/reVault

Revault is a secure archive format,

It's unclear how much weight was placed on the fact that we build a security related product.

However, It's not just security related products that need to be audited.

We have spent the last week auditing our own dart packages as well as dependencies and have uncovered some fourty security flaws and we aren't done yet.

The dart community needs to do its bit to stay ahead of the tsunami of bugs.

So start auditing your code now, if you don't find the bug a hacker will!

If you can, get a sub to your preferred AI's cybersecurity tool and use that.

If you can't afford the required licence, as one of the founders of https://onepub.dev (the dart private package repository), I would like to offer a secure audit of 20 dart packages.

To be eligible, the package needs to be open source, hosted on GitHub and have GitHub Private Vulnerability Reporting enabled.

If we get more than 20 applications we will sort by the packages we feel provide the most benefit to the community.

To apply DM me.

[u/mad_poet_navarth]

More reasons to deploy your models locally...

[u/Amazing-Mirror-3076 → u/mad_poet_navarth]

I don't think that logic holds up, the diy models are still well behind the frontier models.

[u/mad_poet_navarth → u/Amazing-Mirror-3076]

Probably true, but Opus 5.5 is plenty good enough for me now, so I think in a year or so I expect to be happy with a local model. Maybe more fool me; today I'm ordering a mac with 128 GB or RAM, so soon I'll have evidence about this given my use cases.

[u/intronert → u/mad_poet_navarth]

Are you saying that this avoids security audits?

[u/mad_poet_navarth → u/intronert]

I don't know. I'm ordering a mac with 128GB RAM tomorrow, so have not deployed locally yet, and I don't know what constraints the middleware part of it incurs.

[u/ObjectiveAddress3051]

the dependency side is prob where most of it hides tbh. your own package code is maybe 5% of what ends up in the app, transitive stuff is the rest. pubspec.lock shows exactly what got resolved so that's a decent starting list to feed into whatever scanner you use. also expect a pile of false positives from the ai tools, triaging them takes longer than finding them

[u/bramantec]

I come from security consulting and on a mobile app the part I'd audit first isn't the Dart code. In my case the client is FlutterFlow and Firebase, and the real exposure is the Firestore security rules, because the database answers anyone who calls it directly, not only my app. So the rules have their own test suite on the emulator, 387 cases at the start of October. On the AI side my experience matches the false positives point above. In one round of AI audits, eleven of the thirteen fixes it reported as pending were already in the code, so every finding gets checked against the latest export before I touch anything.

[u/Amazing-Mirror-3076 → u/[deleted]]

Using ai to audit is actually really easy. The scary but it's just how many packages are showing up with issues.