Shipping a Flutter app without auditing native permissions, release keystores, or asset bloat?
To help Flutter developers catch hidden production risks before App Store/Play Store review, I built flutter_auditor — an open-source, zero-config CLI health and security inspector for Flutter & Dart.
In just one terminal command (dart run flutter_auditor), it scans your project for:
🔒 17+ Automated Audits:
Hardcoded API secrets & exposed .jks keystores
Missing iOS Info.plist privacy description strings
Unused heavy assets & broken 2.0x/3.0x image variant paths
Dangerous manifest flags (android:debuggable="true", allowed cleartext traffic)
Unused & transitive package dependencies
Give it a try locally on your project and let me know what audits you'd like to see next! 👇
pub.dev: https://pub.dev/packages/flutter_auditor
GitHub: https://github.com/thakaredipali/flutter_auditor
Top comments (1)
The Info.plist check is the one I would have wanted a year ago. Missing camera and mic usage descriptions is a classic late rejection: the build runs fine locally, TestFlight is happy, and it comes back from review. Catching that from the CLI before submission is worth the install on its own. Nice first release.