Common concerns

Shared objects should use fortified functions

The shared object does not have any fortified functions.
Fortified functions provides buffer overflow checks against glibc’s commons insecure functions like strcpy, gets etc.
Use the compiler option -D_FORTIFY_SOURCE=2 to fortify functions.

When this refers to compiled Dart code
(such as the libapp.so file in Flutter applications),
this advice is misguided because Dart code doesn’t
directly invoke libc functions;
all Dart code goes through the Dart standard library.

(In general, MobSF gets false positives here because
it checks for any use of functions with a _chk suffix,
but since Dart doesn’t use these functions at all,
it doesn’t have calls with or without the suffix,
and therefore MobSF treats the code as containing
non-fortified calls.)

Shared objects should use RELRO

no RELRO found for libapp.so binaries