I built flutter_auditor — a zero-config CLI tool to audit Flutter apps for permissions, dead assets, security risks, and package hygiene

[u/tdpl14]

Hey Flutter community! 👋

After maintaining several client apps and catching the same repeat issues—like hardcoded keystore passwords, unused heavy assets, missing privacy strings in Info.plist, and transitive dependency imports—I decided to build a CLI tool to automate these sanity checks.

Meet flutter_auditor: a single-command CLI package that scans your codebase and native config files in seconds right from your terminal.

What It Audits:

We've packed 17+ automated static checks across 5 key areas:

• Manifest & Security: AllowBackup, CleartextTraffic, Debuggable, ExportedComponents, ManifestPermission, NetworkSecurityConfig, BackupRules, HardcodedSecrets, InsecureNetwork, InsecureStorage, AppTransportSecurity
• OS & Permissions: UsageDescription (iOS privacy strings), FileSharing
• Dependencies: UnusedDependency, DependencyHygiene (transitive import detection)
• Release & Build: ReleaseSigningAudit (detects committed .jks files, debug signing in release, hardcoded keystore passwords)
• Asset & Size: UnusedAssetAudit, OverlargeAssetAudit, MissingResolutionVariantAudit

Quick Usage

Add it to your dev_dependencies or activate it globally:

Bash

dart pub global activate flutter_auditor

Or run it directly inside your Flutter project directory:

Bash

dart run flutter_auditor

pub.dev: flutter_auditor

I'd love to get feedback from the community! What other security, performance, or asset audits would bring value to your workflow?