Investigate Google OAuth client secret

Build 1.6.7 · Scan 2026-09-22T09:58:44.961Z

1 distinct recorded findings; 1 have inspectable metadata. Locations are representative, not an inventory of every source match.

A Google OAuth client secret. Shipping this in a mobile client is a misconfiguration — it can allow impersonation of the app's OAuth flow.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

assets/flutter_assets/.env

Recorded match

•••••••• (21–40 chars, redacted)

Detector rule

google_oauth_secret

Recorded file locations