Rules / Dart
SHIELD-DART-009
Sensitive data in insecure storage
What it detects
Storing passwords or tokens in SharedPreferences saves them in plaintext accessible to other processes.
How to fix
Use flutter_secure_storage or the platform keystore for sensitive values.
Vulnerable — Shield flags thissession_cache.dart
import 'package:shared_preferences/shared_preferences.dart';
Future<void> cacheSession(String token) async {
await (await SharedPreferences.getInstance()).setString("authToken", token);
}
Fixed — scans cleansession_cache.dart
import 'package:flutter_secure_storage/flutter_secure_storage.dart';
const _storage = FlutterSecureStorage();
Future<void> cacheSession(String token) async {
await _storage.write(key: "authToken", value: token);
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-009, the fixed one does not.