Security: fluttersdk/wind

Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

VersionSupported
1.x✅
0.0.x❌

Reporting a Vulnerability

If you discover a security vulnerability in Wind, please report it responsibly.

The preferred channel is GitHub's private vulnerability reporting: Open a private vulnerability report

This keeps the disclosure confidential until a fix is ready and lets maintainers coordinate a CVE assignment through GitHub's advisory workflow.

As a secondary route, you may also email security@fluttersdk.dev with:

  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment

We will acknowledge receipt within 48 hours and aim to provide a fix or mitigation plan within 7 days.

Threat Model

Wind treats all className input as data. The parser tokenises and maps strings to Flutter styling properties; it never evaluates code from user-supplied class names.

The primary security boundary is the WDynamic JSON renderer:

  • Widget allowlist (WDynamicConfig.defaultWindWidgets and defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only type strings present in these two sets (or in config.builders) are dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface further by naming types that must be blocked even if they appear in the default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent deeply nested JSON from becoming a stack-exhaustion vector.

Consumers rendering JSON from untrusted sources should review the default allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.

Scope

This policy covers the fluttersdk_wind Dart/Flutter package. Issues in upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps) are out of scope and should be reported to their respective maintainers.

Token Rotation

Two GitHub Actions secrets carry elevated access and should be rotated every 90 days:

  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the release-please workflow to create release PRs and push version commits. Regenerate at GitHub Settings > Developer settings > Personal access tokens, then update the secret under the repository's Settings > Secrets and variables > Actions.

  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation in CI. Regenerate through the Anthropic console or the Claude Code settings that issued the original token, then update the corresponding GitHub Actions secret in the same location as above.

After updating a secret, trigger the affected workflow manually to confirm the new credential is accepted before the old one expires.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: fluttersdk/wind
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
VersionSupported
1.x✅
0.0.x❌
Reporting a Vulnerability
If you discover a security vulnerability in Wind, please report it responsibly.
The preferred channel is GitHub's private vulnerability reporting:
Open a private vulnerability report
This keeps the disclosure confidential until a fix is ready and lets maintainers
coordinate a CVE assignment through GitHub's advisory workflow.
As a secondary route, you may also email security@fluttersdk.dev with:
  • A description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Any potential impact assessment
We will acknowledge receipt within 48 hours and aim to provide a fix or
mitigation plan within 7 days.
Threat Model
Wind treats all className input as data. The parser tokenises and maps strings
to Flutter styling properties; it never evaluates code from user-supplied class
names.
The primary security boundary is the WDynamic JSON renderer:
  • Widget allowlist (WDynamicConfig.defaultWindWidgets and
defaultFlutterWidgets in lib/src/dynamic/w_dynamic_config.dart): only
type strings present in these two sets (or in config.builders) are
dispatched. The dispatch loop in lib/src/dynamic/w_dynamic_renderer.dart
calls config.isAllowed(type) before constructing any widget.
  • Deny list (config.denyWidgets): callers can shrink the allowed surface
further by naming types that must be blocked even if they appear in the
default sets.
  • Depth limit (config.maxDepth, default 50): caps recursion to prevent
deeply nested JSON from becoming a stack-exhaustion vector.
Consumers rendering JSON from untrusted sources should review the default
allowlist, tighten it with denyWidgets, and set an appropriate maxDepth.
Scope
This policy covers the fluttersdk_wind Dart/Flutter package. Issues in
upstream dependencies (Flutter SDK, flutter_svg, and other transitive deps)
are out of scope and should be reported to their respective maintainers.
Token Rotation
Two GitHub Actions secrets carry elevated access and should be rotated every
90 days:
  • RELEASE_PLEASE_TOKEN: a GitHub Personal Access Token (PAT) used by the
release-please workflow to create release PRs and push version commits.
Regenerate at GitHub Settings > Developer settings > Personal access tokens,
then update the secret under the repository's Settings > Secrets and
variables > Actions.
  • CLAUDE_CODE_OAUTH_TOKEN: an OAuth token used by Claude Code automation
in CI. Regenerate through the Anthropic console or the Claude Code settings
that issued the original token, then update the corresponding GitHub Actions
secret in the same location as above.
After updating a secret, trigger the affected workflow manually to confirm the
new credential is accepted before the old one expires.
 There aren't any published security advisories