Fixes land on the latest release; older versions are not patched.

Please do not open a public issue for a security problem.

Report it privately through GitHub:

1. Go to the Security tab.
2. Choose Report a vulnerability.

That opens a private advisory visible only to you and the maintainers.

Useful things to include:

• The command you ran and the flags you passed
• The Dart and Flutter versions (dart --version, flutter --version)
• What happened, and what you expected instead
• A minimal reproduction if you have one

We will follow up on the advisory thread, and agree a disclosure timeline with you before publishing anything.

Knowing the attack surface usually settles the question faster than a report does. FlutterGenCat:

• makes no network requests of any kind, and sends no telemetry
• starts no subprocesses
• uses no dart:ffi and no reflection
• handles no credentials, tokens or secrets
• writes files — this is its whole job — and reads the target project's pubspec.yaml to decide which Dart language version to format for

All of its direct dependencies (args, dart_style, path, pub_semver, yaml) are published by the Dart team.

• Writing outside the directory the user asked for, given valid input
• Feature or artifact names escaping validation and reaching the filesystem
• Generated code that introduces a vulnerability into the host application
• Anything that turns a malformed pubspec.yaml into code execution

• --output pointing outside the project. --output ../shared/features is supported on purpose; a monorepo may legitimately want it. The tool writes where you tell it to.
• UnimplementedError in generated stubs. Scaffolded repositories and data sources throw until you implement them. That is deliberate — a stub returning plausible fake data is far more likely to reach production unnoticed.
• Findings that require an attacker to already control the machine running the CLI, or the contents of the project it is run against.