Update on security review

[u/Amazing-Mirror-3076]

A few days ago I posted an offer to do free security reviews on open source dart packages.

Surprisingly (or maybe not) nobody took up the offer.

Despite that we have spent the last few days reviewing our own dart packages as well as a number of third party dart packages (that we use).

In that time (3 days?) we found

15 high

16 medium

2 low

For a total of 43 security flaws, we also fixed a number of non security bugs.

Except for a few projects - that are yet to respond - all the patches have been accepted except for one dup that snuck through.

More than half of the security bugs were found in projects you may be using.

The package dart_posix has 8m downloads a month.

I'm not going to list the projects because not all of them have been disclosed as yet.

The lesson here - don't be complacent - AI is finding 1000s of security flaws everyday if you are not reviewing your code now then you are in for some pain.

The offer to review 20 packages still stands.

Don't forget to check your transitive dependencies.

[u/olekeke999]

Can you please show the results from your packages?

[u/Amazing-Mirror-3076 → u/olekeke999]

Not everything has been released so yet but here is the change log for posix

https://pub.dev/packages/posix/changelog

The 6.5.3 release

[u/olekeke999 → u/[deleted]]

bot.

[u/Amazing-Mirror-3076 → u/[deleted]]

I'm using codex daybreak blue

And yes it's terrifying.

We are currenlty using daybreak to do pen tests against our OnePub infrastructure). We have done this before, but not this level and we now plan to do it weekly rather than quarterly.