Security false positives

Introduction

Common concerns

Shared objects should use fortified functions
Shared objects should use RELRO
Shared objects should use stack canary values
Code should avoid using the _sscanf, _strlen, and _fopen APIs
Code should use calloc (instead of _malloc) for memory allocations
The iOS binary has a Runpath Search Path (@rpath) set
CBC with PKCS5/PKCS7 padding vulnerability
Apps can read and write to external storage
Apps delete data using file.delete()

Obsolete concerns

The stack should have its NX bit set

Reporting real concerns

Introduction

We occasionally receive false reports of security
vulnerabilities in Dart and Flutter applications,
generated by tools that were built for other kinds
of applications (for example, those written with Java or C++).
This document provides information on reports that we believe
are incorrect and explains why the concerns are misplaced.