Sample: Dart — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Dart

This PR intentionally introduces insecure patterns so you can see SquidGate work on Dart:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/dart/demo.dart

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The new demo file introduces multiple clear security vulnerabilities: hardcoded credentials, SQL injection, and potential command injection, all explicitly marked as intentional for demonstration.

⛔ 2 finding(s) block merge.

MEDIUM — Hardcoded API Key

File: examples/dart/demo.dart:2 | Confidence: high

A hardcoded API key is embedded directly in source code. This exposes the credential in version control and any deployed artifacts, violating secure secret management practices.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded key. Load secrets from environment variables or a secure vault, e.g., const apiKey = String.fromEnvironment('API_KEY');

---

HIGH — SQL Injection via String Interpolation

File: examples/dart/demo.dart:4 | Confidence: high

User-controlled 'id' parameter is directly concatenated into a SQL query string using single quotes, enabling SQL injection attacks when the query is executed.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or prepared statements provided by the database library instead of string concatenation.

---

HIGH — Insecure Command Construction

File: examples/dart/demo.dart:9 | Confidence: high

User input is interpolated into a shell command string ('sh -c echo $input'). If passed to Process.run or similar, this enables OS command injection.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid shell invocation with user input. Use Process.start with a list of arguments or validate/sanitize input strictly if shell is required.

---