Zennoxa Shield
Rules / Dart
SHIELD-DART-006

Insecure cleartext HTTP endpoint

mediumDartCWE-319CVSS 6.5

What it detects

Using a cleartext http:// URL transmits data without encryption and exposes it to interception.

How to fix

Use HTTPS endpoints and enforce TLS for all network requests.

Vulnerable — Shield flags thislogin_api.dart
import 'package:http/http.dart' as http;

Future<int> submitLogin(String email) async {
  final res = await http.post(
    Uri.parse("http://api.example.com/v1/login"),
    body: {"email": email},
  );
  return res.statusCode;
}
Fixed — scans cleanlogin_api.dart
import 'package:http/http.dart' as http;

Future<int> submitLogin(String email) async {
  final res = await http.post(
    Uri.parse("https://api.example.com/v1/login"),
    body: {"email": email},
  );
  return res.statusCode;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-006: Insecure cleartext HTTP endpoint — Zennoxa Shield