Sensitive Credentials Stored in Plain Text Files Without Encryption
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- dart, flutter
- Domain
- mobile-dev, security
Research direction
Locate the credential-storage code that writes profiles/{profile}/taskc_client_id and profiles/{profile}/taskc_client_secret, then trace how storage differs on Android and iOS. Review the existing SharedPreferences usage and available platform-secure storage options; done means credentials are encrypted or kept in platform secure storage rather than directly readable from the local file system.
Written by the indexing model from the issue text.
Description
Describe your issue
The application stores sensitive credentials such as clientId and encryptionSecret in plain text files inside the local file system (profiles/{profile}/). These files are not encrypted, making the data vulnerable if the device is compromised (e.g., rooted Android or jailbroken iOS).
Although SharedPreferences is used, it only stores the base directory path. The actual issue lies in insecure file storage of sensitive data.
This can lead to unauthorized access, credential leakage, and potential misuse of backend APIs.
Steps to reproduce
Install and run the application
Login or initialize credentials storage
Navigate to the app’s local storage directory
Open the path:
/profiles/{profile}/taskc_client_id
/profiles/{profile}/taskc_client_secret
Observe that credentials are stored in plain text
What was the expected result?
Sensitive credentials should be stored securely using encrypted storage mechanisms such as:
Secure Keychain (iOS)
Android Keystore
Or encrypted storage solutions
Credentials should not be directly readable from the file system.
Put here any screenshots or videos (optional)
No response
How can we contact you (optional)
No response
Would you like to work on this issue?
Yes
By submitting this issue, I have confirmed that:
- I have starred the repo ⭐ and watched 👀 it on GitHub and followed the contribution guidelines.
- Dominant language
- Dart
- Stars
- 244
- Forks
- 179
- Avg merge
- 12h 42m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CCExtractor/taskwarrior-flutter
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
CCExtractor/taskwarrior-flutter#639 · 2 comments ·
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
CCExtractor/taskwarrior-flutter#647 · 1 reaction ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 52/100
CCExtractor/taskwarrior-flutter#643 · 1 comment ·
All issues in CCExtractor/taskwarrior-flutter
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
code quality good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Suwayomi/Suwayomi-Tsumiru#479 ·
-
Build Failure: agora_rtc_engine compiled against android-31 while dependencies require android-34+ Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 92/100
conceptadev/noir#95 ·