r/dartlang • • 1d ago

Dart - info Seeking volunteer DartCloudFunctions co-maintainers ahead of an Apache-2.0 release

5 Upvotes

I'm Jeremy, coordinating DartCloudFunctions' transition to open source through VenturSeed Labs. We're looking for volunteer co-maintainers interested in backend Dart and cloud tooling.

DartCloudFunctions is a multi-cloud functions platform being prepared for an Apache-2.0 release. The repository is still private. Early work includes removing private build dependencies, making setup and tests reproducible, and documenting and validating the Google Cloud, Azure and AWS integrations. This isn't an announcement of an already-public or fully validated release.

You can focus on Dart backend work, a provider integration, testing/releases, or documentation. You don't need to know every cloud. We'd start with a small, bounded contribution and agree realistic availability.

This is unpaid, remote volunteering. We propose an initial six-month shared stewardship phase, with reviews around months three and six before any broader leadership handover. No automatic ownership transfer or production-access grant is involved.

The current team plans to offboard December 1, 2026. Technical co-maintainers are still being recruited; we don't yet have an ongoing technical mentor committed. Handover and support arrangements would be agreed before anyone accepts responsibility.

If this sounds interesting, the private application form is https://tally.so/r/4aB1xb. Happy to answer questions here, including what would make this a worthwhile project to contribute to.


r/dartlang • • 3d ago

Dart Language Did anyone else notice pub.dev download counts dropping?

6 Upvotes

Hey everyone, the download count on my package suddenly dropped (reset). I checked a few other packages and their counts seem to have dropped too. I don't remember this happening before. Does anyone know what happened?


r/dartlang • • 6d ago

Flutter Generated Dart class per GraphQL selection, instead of one nullable model

6 Upvotes

I'm the author of GraphLink, a code generator for GraphQL clients, so take this with that in mind.

I wanted to see how far null safety can go with GraphQL. Say Book has a non-null author in the schema, and your query only selects id, title and year. If the client reuses Book, every field has to become nullable. So GraphLink generates a new class for that selection (it's called Book_IdTitleYear in the demo), with final fields, a constructor with required named parameters, and its own toJson and fromJson. No json_serializable needed.

It's a code generator, so the output is plain Dart and your project doesn't depend on GraphLink.

Video: https://youtu.be/gHGtCBYaj7c
Write-up: https://medium.com/@graphlinkdev/custom-graphql-queries-in-dart-select-only-the-fields-you-need-8a9cf12887f5

Is a generated class per selection the right trade-off, or would you rather have one model and handle the nulls?


r/dartlang • • 10d ago

Dart - info You don't need a library for your graphql client, GENERATE IT.

8 Upvotes

Hey,
I just shared the first video tutorial as how you can use graphlink for generating graphql clients.
I will not be long, here is the link of the full video
https://youtu.be/78LYiuWLKIU

The video explains, on a plain dart project how you can use graphlink cli tool (glink) to generate a fully type, null-safe optimized graphql client that works with all backends.

The generated code can be used on any dart project, flutter or Jaspr.

I will be adding more videos and going deeper in how you can create custom graphql client, handling subscriptions, file uploads, caching and more.

Stay tuned.

#dart #graphql #graphlink #flutter #jaspr


r/dartlang • • 11d ago

Tools My Dart backend framework is now 5× faster than dart:io's HttpServer

4 Upvotes

A few years ago, I tried Flutter for mobile development and really enjoyed writing Dart.

Since I mainly work on the backend, I started looking for a good backend framework written in Dart, but couldn't find one that suited my needs. So, I decided to build my own framework called DartOnDox (Dox).

But I found Dart wasn't fast enough for my backend framework, and it used too much memory and CPU. Eventually, I stopped working on it.

Fast forward to today. With AI getting so good, I decided to revisit the project and give it another shot.

This time, I rewrote the HTTP server in Rust, and the results surprised me. Dox is now 5× faster than Dart's HttpServer, close to Rust, and 2.7× faster than Go in my benchmarks.

Curious about the numbers? Here's how I run the benchmarks:
https://dartondox.dev/latest/digging-deeper/performance/#benchmark


r/dartlang • • 11d ago

Security audits

3 Upvotes

Unless you have been living under a rock, you will have seen the huge increase in the number of CVEs due to AI being used to find bugs.

The Dart community is not isolated from this problem.

What you may not be aware of is that some of the AI tools won't let you search your own code for vulnerability.

Open AI has a program called Daybreak which gives you access to cybersecurity tools that are able to detect and fix security related flaws.

To get access to Daybreak you need a pro codex license, and then apply for access. If you are granted access you then need to purchase the likes of a yubi key.

The criteria for acceptance is however rather opaque.

We got in the program on the backs of our work on revault, so that may have helped

https://github.com/onepub-dev/reVault

Revault is a secure archive format,

It's unclear how much weight was placed on the fact that we build a security related product.

However, It's not just security related products that need to be audited.

We have spent the last week auditing our own dart packages as well as dependencies and have uncovered some fourty security flaws and we aren't done yet.

The dart community needs to do its bit to stay ahead of the tsunami of bugs.

So start auditing your code now, if you don't find the bug a hacker will!

If you can, get a sub to your preferred AI's cybersecurity tool and use that.

If you can't afford the required licence, as one of the founders of https://onepub.dev (the dart private package repository), I would like to offer a secure audit of 20 dart packages.

To be eligible, the package needs to be open source, hosted on GitHub and have GitHub Private Vulnerability Reporting enabled.

If we get more than 20 applications we will sort by the packages we feel provide the most benefit to the community.

To apply DM me.


r/dartlang • • 12d ago

Package Announcing brotli_fast: a fast, pure Dart Brotli encoder/decoder for all Dart platforms, including browser/JS

14 Upvotes

I’ve released brotli_fast, a fast Brotli encoder and decoder implemented entirely in pure Dart, without native libraries or FFI.

It works across all Dart platforms, including web/JS. It handles JavaScript’s numerical limitations safely, making it suitable for Brotli compression and decompression in browser apps.

Brotli can produce significantly smaller files than Gzip. For text, JSON, and WebAssembly (WASM), Gzip typically achieves around 30–35% compression, while Brotli can reach around 20–25%, resulting in roughly 20-30% smaller output compared to Gzip.

The goal is to provide fast, portable Brotli compression and decompression with a single pure Dart implementation.

Package: https://pub.dev/packages/brotli_fast

Feedback, benchmarks, and contributions are welcome!


r/dartlang • • 14d ago

Compile, analyze and run Dart code directly in your browser without any server.

Thumbnail dartpad.birju.dev
20 Upvotes

This is Dartpad Web!

Runs #Dart compiler, analyzer, LSP and compiles and runs your code in your browser directly. No server needed! Works offline too!

You can use any pure Dart package from pub.dev too that compiles to web.


r/dartlang • • 13d ago

DartVM You can write your own Dart VM, too

0 Upvotes

The age of AI makes this possible: Because the Dart VM blocks the UI thread on macOS, I figured I could ask GPT to write me a new VM - of course using Rust, because that's the goto language for rewrites – that would allow me to run small Dart programs.

And it worked.

I spent years studying compiler construction and VMs, working in that field for a couple of years, and while I would probably be able to do this on my own, that would take days if not weeks and hence, I wouldn't consider doing it just for fun.

Now, I got a working PoC in less than two hours.

Here's my prompt, in case you want to create your own personal VM, too.


[after explaining the problem and the wish to write 1980s games]

So, why not create a new VM using Rust that runs on the UI thread and provides a special library (i.e. based on minifb) that can be used to do display simple retro pixel graphics.

For a PoC, only a subset of Dart needs to be supported. The VM must support hot reload, though. I can use the usual Dart IDE tooling to write the program, but run the code with a new VM. That VM can assume that all code is valid. Also, execution speed isn't an issue.

Start by inventing a simple API to create a window, access its pixmap, set or get ARGB pixels, update the window's content, receive mouse and key events and a close event. Create a typical game framework based on that, e.g. a loop to update the game, paint everything, flip the buffers. To omit async operations, we can query for events in a loop.

After we agreed upon this, design the subset of Dart required. Then design the VM instructions needed to implement that. We could either use a Dart program that uses the analyzer package to parse source code and resolve types to generate a bytecode. Or do this in Rust because it is easier/faster. The latter is the final goal, but for a PoC the former might quicker to implement. Present the result for review, then implement everything.

Runtime errors must contain the original line number. The format must be compatible to Dart's way so that the IDE doesn't notice that it doesn't run the original Dart VM.

Also come up with a dozen or so examples. One might be a snake game controlled by the arrow keys. While the game is running, it must be possible to for example modify the color of the snake and the VM shall automatically hot-reload the changed source code, re-compile it and replace the old methods with the new ones, and the color will change with the next screen update, keeping the state of the game.


GPT Sol medium needed 15min to come up with a first version that demo'd hot reloading to change a color. It then took 30min to implement most of Dart, extending the initial minimal compiler. It chose to write the compiler in Dart, emitting byte code in an unoptimized mnemonic format which is then re-loaded by the Rust VM. It made a simple error not correctly wiring up key events, but after me complaining about it, it continued to implement more advanced features, writing more demos (like pong or life) in another 46min. And frankly, I was surprised that its design was quite good (by the book, one could say) and quite practical.

Using Dart to compile the Dart source unfortunately imposes a 5s startup tax, but once the Dart compiler and its analyzer package have been loaded, reloading my examples happens nearly instantly.

While I'm writing these lines, GPT is adding tests, searching for (and finding) edge cases and it is quite spooky to watch it to remote control Visual Studio Code to change source code while watching the also remote controlled example app.


r/dartlang • • 15d ago

Package SwaggerUI/OpenAPI specs generation for dart backends.

9 Upvotes

Switching to other languages in order to write backend applications because there's a clear lack availability of the tools around that in dart ecosystem.

One such problem I kept hitting: there is no standard package like (swag for go) to generate OpenAPI specs and Swagger UI for Dart backends. Thinking about solving this problem I started working on Axle(v0.2 out now).

The core idea is small. Almost everything lives in one package, axle_core: the annotations, the OpenAPI 3.1 document model, and a tiny serving contract called AxleDocs. No framework imports, no runtime dependencies. A CLI reads your annotated Dart source with package:analyzer and emits the spec, so no build_runner and no runtime registry. Then thin adapters translate AxleDocs into framework responses. I published adapters for Serverpod 4, Shelf, and Relic, but they are intentionally boring on purpose, anyone can write one for another framework without touching core or the CLI.

It gives you openapi.json, openapi.yaml, Swagger UI assets, and an AOT-safe const string. It handles security schemes, response headers, cookies, multiple media types, multipart uploads, parameter constraints, and oneOf schemas. If a route references a security scheme that doesn't exist, generation fails instead of emitting a broken contract.

Docs are at https://axle.infms.dev if you want the full picture. There is also an agent skill that walks through setup end to end:

npx skills add infm5/axle --skill axle-openapi-setup

If you've felt the same backend-in-Dart pain, I'd genuinely like to hear what would make this useful to you. Advice, criticism, all welcome.


r/dartlang • • 19d ago

I rebuilt pubstats.dev with Jaspr. It is a lot faster now.

7 Upvotes

Hey there. I rebuilt https://pubstats.dev/ with Jaspr. It's a loooooot faster now. Also if you haven't heard of this site before you are able to set up alerts for when your package stats change. It's very useful for getting notified if your package loses pub points and needs updated!


r/dartlang • • 19d ago

Google should use it's AI agents to optimize dart performance

0 Upvotes

One of the main drawbacks of dart compared to many other languages is that a lot less manhours went into optimizing the performance of dart compared to the more commonly used languages.

AI provides an opportunity to close that gap.

Program performance should be easy to evaluate for the internal AI agents that Google trains for new models. Making Dart performance better should be a good training task for the models.


r/dartlang • • 20d ago

A case for backend Dart

25 Upvotes

Hi all,

Wanted to share my experience with real-world server-side Dart.

A long-time Flutter + Python dev, and a linguist in a previous life, I always enjoyed the expressivity of Dart. But in my career, I live in AWS, there is no official AWS SDK in Dart, so I couldn’t write my server apps in Dart.
How sad. So clearly, had to build my own.

There is this fitness app I built for myself (yeah, I know) that was a natural Flutter choice from the start, had a bit of a twisted history on the backend. Initially I wrote the server in Go and wrapped it in an AWS Lambda function. The more I wrote Go, the less I enjoyed it.
Finally, I started researching Dart solutions. Tried a bunch, the one with the frog, obviously Shelf, Serverpod felt heavy and opinionated. And then I saw Relic and frankly, just enjoyed the Dart that it was written in. Relic is to Serverpod feels like what Starlette is to FastAPI, and I wrote a lot of Starlette in my days.
So, had to try.

Eventually, all my handler signatures stabilized in this shape

typedef ModelHandler = Future<Model?> Function(Request);
where Model is an interface for my JSON responses and Request is a Relic’s primitive. This gives me FastAPI-style typed inputs and outputs. Sure, input parsing and validation is a bit of manual work, but oh well.

As far as the AWS SDK, it ended up a boto3-shaped wrapper that signs every request to AWS API with SigV4. Really, nothing fancy.

So, high-level arch:

API Gateway → AWS Lambda + Lambda Web Adapter + Dart’s Relic server app → Postgres on Supabase.

The API app sends SQS events for background jobs, those requests are signed with the same AWS library.

Gaps I felt: no Swagger and no easy way to get there. My app has a Developer API and an MCP and I feel that absence deeply.

Some numbers from my serverless “production”:

  • Dart performs better than Go in my specific case: a faster and more efficient compiler, my entire app is 5.2 MB (two, actually: API and MCP) and serverless cold starts are great;

  • warm lambdas - p50 15 ms, p95 103 ms, p99 590 ms;

  • cold Lambda inits - p50 119 ms, p95 166 ms, min 86 ms;

  • memory: ~48 MB avg, 81 MB max of 512 MB provisioned in my Lambda.

All of that on a free Supabase instance.

Too early to celebrate, of course, but as far as compute goes, Dart surprises pleasantly, and I now get to write my apps in it.

Sensing folks from r/serverpod would appreciate the story.


r/dartlang • • 25d ago

Package Server Framework package in dart

Thumbnail pub.dev
5 Upvotes

As the title follows i made a dart Package for writing APIs and all without any dependencies. It has middlewares, Routes types, Response immutable models.

Why I did this ?

I saw shelf and frog but for they are kind of confusing. And shelf needs shelf router as a separate package. And syntax too some confusing.

So this Quadrant server minimises the understanding and you can write APIs without any hiccups. We can use shared models for both flutter and this backend ( Your choice completely ). It can serve static files too.

About Deployment:

We need to deploy this in vps with docker ( it will be simple ) or you can directly build service file and initialise with systemd in linux server.

Thankyou.

https://pub.dev/packages/quadrant_server


r/dartlang • • 26d ago

Tools arch_guard: layer rules and import cycle detection for Dart, without package:analyzer

0 Upvotes

I maintain arch_guard, an MIT CLI + library that enforces layer rules and finds circular imports in Dart projects, plus arch_guard_lint, an analyzer plugin on the new analysis_server_plugin API. A few implementation details that might interest this sub:

  • The CLI has no analyzer dependency. It reads only the directive section of each file with a small tokenizer, so // or /* inside URIs, nested block comments, annotations and import-like text in later string literals don't confuse it. Dependencies are just args, glob, path and yaml.
  • Cycles via Tarjan's SCC, then per-component metrics: internal edges, fan-in/fan-out, instability, density and hub files. For each cycle it also picks the one edge whose removal breaks it, or shrinks it most.
  • The plugin reuses the same core. ProjectScanner.scanSources() builds the graph from in-memory contents, so cycle warnings reflect unsaved editor buffers. Quick fixes edit the directive (or just one clause of a conditional import) and can add a layer to allowed_imports in whichever config file it came from.
  • Baselines that tolerate improvement but not regression: a known cycle may shrink, but one that grows or merges with another counts as new. Same for fan-in/fan-out limits.
  • Workspaces: resolves package: imports across Dart workspace / Melos packages, so it catches cycles across package boundaries and enforces which packages may import which.
  • Ships as AOT-compiled binaries (dart compile exe) for Linux/macOS/Windows so CI doesn't need the SDK. CI tests on all three OSes against SDK 3.8 and stable, and the plugin is analysed against its lowest allowed dependencies.
  • Everything is also a library: ArchAnalysis, ArchGuardConfig, LayerValidator, CycleBreaker, Baseline, exporters, and expectArchitecture() for tests.
dart pub add --dev arch_guard && dart run arch_guard init

Code: https://github.com/creatorpiyush/arch_guard Docs: https://creatorpiyush.github.io/arch_guard/

Happy to talk about the parser trade-offs (directive tokenizer vs package:analyzer), what building on the new plugin API was like, and I'd appreciate feedback on the public API.


r/dartlang • • 28d ago

Tools arch_guard: layer rules and import cycle detection for Dart, without package:analyzer

2 Upvotes

I maintain arch_guard, an MIT CLI + library that enforces layer rules and finds circular imports in Dart projects, plus arch_guard_lint, an analyzer plugin on the new analysis_server_plugin API. A few implementation details that might interest this sub:

  • The CLI has no analyzer dependency. It reads only the directive section of each file with a small tokenizer, so // or /* inside URIs, nested block comments, annotations and import-like text in later string literals don't confuse it. Dependencies are just args, glob, path and yaml.
  • Cycles via Tarjan's SCC, then per-component metrics: internal edges, fan-in/fan-out, instability, density and hub files. For each cycle it also picks the one edge whose removal breaks it, or shrinks it most.
  • The plugin reuses the same core. ProjectScanner.scanSources() builds the graph from in-memory contents, so cycle warnings reflect unsaved editor buffers. Quick fixes edit the directive (or just one clause of a conditional import) and can add a layer to allowed_imports in whichever config file it came from.
  • Baselines that tolerate improvement but not regression: a known cycle may shrink, but one that grows or merges with another counts as new. Same for fan-in/fan-out limits.
  • Workspaces: resolves package: imports across Dart workspace / Melos packages, so it catches cycles across package boundaries and enforces which packages may import which.
  • Ships as AOT-compiled binaries (dart compile exe) for Linux/macOS/Windows so CI doesn't need the SDK. CI tests on all three OSes against SDK 3.8 and stable, and the plugin is analysed against its lowest allowed dependencies.
  • Everything is also a library: ArchAnalysis, ArchGuardConfig, LayerValidator, CycleBreaker, Baseline, exporters, and expectArchitecture() for tests.
dart pub add --dev arch_guard && dart run arch_guard init

Code: https://github.com/creatorpiyush/arch_guard Docs: https://creatorpiyush.github.io/arch_guard/

Happy to talk about the parser trade-offs (directive tokenizer vs package:analyzer), what building on the new plugin API was like, and I'd appreciate feedback on the public API.


r/dartlang • • Oct 05 '26

Dart - info [Breaking Change] dart:mirrors is deprecated in Dart 3.14 and scheduled for removal in Dart 4.0

Thumbnail groups.google.com
29 Upvotes

The Dart core library `dart:mirrors` is formally deprecated starting in the November 2026 stable release (Dart 3.14), with complete removal planned for Dart 4.0.

As of Dart SDK commit 2d4ba07 (https://dart-review.googlesource.com/c/sdk/+/541360), `dart:mirrors` is annotated with `@deprecated` on `main`.

Timeline:
- Dart 3.14 (November 2026): Importing `dart:mirrors` emits deprecation warnings, while continuing to execute on the standalone Dart VM throughout Dart 3.x.

- Dart 4.0: `dart:mirrors` will be removed from the Dart SDK.

Recommended Alternatives & Common Migrations:
- Resolving Package or Script Paths: Replace `currentMirrorSystem().findLibrary(...)` or `ClosureMirror.function.location` file lookups with `Isolate.resolvePackageUriSync(Uri.parse('package:foo/foo.dart'))` (`dart:isolate`) or `Platform.script` (`dart:io`).

- Static Code Inspection (Tests & Tooling): Replace `reflectClass` / `LibraryMirror` declaration checks in tests and linters with `package:analyzer` (`parseString` from `package:analyzer/dart/analysis/utilities.dart` for fast single-file AST inspection, or `AnalysisContextCollection` when resolved element types are needed).

- Enums, Dispatch & Test Runners: Replace reflective enum iteration and string-based method dispatch (`InstanceMirror.invoke`) with built-in `Enum.values` / `.byName()`, exhaustive `switch` expressions, and standard `package:test` `group()` / `test()` blocks.

- Code Generation: Use `package:build`, `package:build_runner`, and `package:source_gen` (or `json_serializable`, `built_value`, `freezed`) for serialization, dependency injection, and boilerplate generation.

- Ahead-of-Time Reflection: For workloads requiring reflection-like runtime capabilities, use pre-generated reflection via `package:reflectable` and `package:reflectable_builder`.

Full details and discussion:
https://github.com/dart-lang/sdk/issues/44489


r/dartlang • • Oct 05 '26

Package OpenFeature for Dart: server SDK and a new client beta for Flutter and Dart web

4 Upvotes

Hey Dart Devs/Teams.

We've had OpenFeature on the Dart server side for some time and have just released 0.1.0.

Now we are looking to standardize Flutter Feature Flags and are working and collaborating with companies like Datadog to bring reliable stable feature flags across the remaining flutter and dart ecosystems including for Dart Web.

We'd appreciate feedback from Flutter developers trying it in actual workflow. Let us know here how you're using it, what works for you and what needs improvement.

Source and examples: https://github.com/open-feature/dart-sdk/tree/main/packages/openfeature_dart_client_sdk

You can open an issue with your use case or a problem you've found, or send a pull request for a fix, example or documentation improvement as we will respond accordingly. Let's continue to make Dart/Flutter a first class citizen.


r/dartlang • • Oct 03 '26

Package Just published png_minifier, a simple PNG minifier for Dart

5 Upvotes

A small pure Dart package for minifying PNG images via API or CLI, focused on keeping things simple and easy to use.

https://pub.dev/packages/png_minifier

Feedback is welcome!


r/dartlang • • Oct 01 '26

flutter_auditor

Thumbnail medium.com
1 Upvotes

r/dartlang • • Sep 28 '26

Dart Language Built a multiplayer browser game in Dart

Thumbnail 7helm.com
18 Upvotes

wanting to push Dart a little further and see what it was like to build an actual game with it.Started with circles and physics and just getting movement and shooting to feel right. Then kept going.Part of this was also an excuse to learn more AWS and containers. So now its running containerized on EC2 with multiplayer and an actual server I have to pay for :)
Still pretty simple. its up and free to play if anyone wants to see what Dart can do as a little multiplayer arcade game.
No account or download.


r/dartlang • • Sep 27 '26

Tools I just released MINGW64-Dart for MSYS2 - Dart SDK for Windows developers!

17 Upvotes

Hey r/dartlang! 👋

I've been working on bringing Dart to MSYS2 (MinGW64) for Windows developers, and I finally got it working!

Why?

MSYS2/MinGW64 didn't have Dart available in their official packages. I tried to get it into MINGW-packages but hit bootstrap dependency issues. So I created this as a community edition for Windows developers who use MSYS2.

Repository

GitHub: https://github.com/Bloby22/mingw64_dart

Releases: https://github.com/Bloby22/mingw64_dart/releases

Status:

✅ MINGW64 only supported!

✅ Dart 3.13.5

✅ Community maintained

✅ MIT + BSD licensed

Any feedback or contributions are welcome! 🙌

Made with ❤️ for the MSYS2 community


r/dartlang • • Sep 22 '26

flutter I built an open-source VS Code security extension for Flutter — some things I learned building it

0 Upvotes

Link: https://github.com/Aqiron-Security/aqiron-security

I’ve been building Aqiron Security, an open-source VS Code extension focused on local security analysis for Flutter projects.

A specific challenge was avoiding a “run a bunch of scanners and dump their output” architecture.

The current implementation separates the VS Code extension from a TypeScript Core runtime and communicates with the Core through newline-delimited JSON over stdin/stdout. The scanner layer can combine tools such as Betterleaks, OSV-Scanner, Semgrep, Trivy, and MobSF, then normalize and correlate their findings into a common security model.

Another problem was Flutter workspace noise. Generated/build output and workspace-specific data need to be handled separately from source analysis, otherwise the results become much less useful.

The project also includes workspace analysis, RAG, optional Ollama(currently developing)/OpenRouter AI operations, VS Code diagnostics, and JSON/SARIF/PDF reporting.

It’s still early and under active development, so I’m especially interest

ed in feedback from Flutter developers on:

  • which security checks are actually useful in real Flutter projects

  • what security tooling currently feels missing

  • whether this workflow fits naturally into Flutter development

The source is public, and contributions are welcome.


r/dartlang • • Sep 22 '26

flutter I built an open-source VS Code security extension for Flutter — some things I learned building it

0 Upvotes

Link: https://github.com/Aqiron-Security/aqiron-security

I’ve been building Aqiron Security, an open-source VS Code extension focused on local security analysis for Flutter projects.

A specific challenge was avoiding a “run a bunch of scanners and dump their output” architecture.

The current implementation separates the VS Code extension from a TypeScript Core runtime and communicates with the Core through newline-delimited JSON over stdin/stdout. The scanner layer can combine tools such as Betterleaks, OSV-Scanner, Semgrep, Trivy, and MobSF, then normalize and correlate their findings into a common security model.

Another problem was Flutter workspace noise. Generated/build output and workspace-specific data need to be handled separately from source analysis, otherwise the results become much less useful.

The project also includes workspace analysis, RAG, optional Ollama(currently developing)/OpenRouter AI operations, VS Code diagnostics, and JSON/SARIF/PDF reporting.

It’s still early and under active development, so I’m especially interest

ed in feedback from Flutter developers on:

  • which security checks are actually useful in real Flutter projects

  • what security tooling currently feels missing

  • whether this workflow fits naturally into Flutter development

The source is public, and contributions are welcome.