cometchat-flutter-v6-push — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cometchat-flutter-v6-push (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ground truth — DOCS-FIRST. Push is an EXTERNAL integration (a Firebase project, native config on both platforms, and a Dashboard provider), not a UI Kit widget. The current setup lives in CometChat's notifications docs — FETCH them, via../cometchat-flutter-v6-core/references/docs-map.md→/notifications/push-overview·/notifications/flutter-push-notifications-android·/notifications/flutter-push-notifications-ios. (The old singular/notifications/flutter-push-notificationsnow redirects to a legacy page — use the per-platform pages above.) This skill bakes ONLY the SDK symbols (verified vscometchat_sdk5.0.6) and the hardening deltas. Symbols baked; the step-by-step is fetched.
cometchat-flutter-v6-core — install, credentials, init→login→render. This skill ASSUMES it (push registers AFTER login, on the SAME SDK).cometchat-flutter-v6-events — the listener lifecycle; a push registration is a lifecycle-bound side effect."add push notifications", "FCM push", "notify me when the app is closed / backgrounded".
google-services.json / GoogleService-Info.plist placement, the Gradle/Podfile changes, and (iOS) the APNs key upload. If the docs are wrong or missing a step, that is a DOCS gap — flag it (`RULES.md` §20), don't bake a permanent workaround.flutter pub add firebase_core firebase_messaging. CometChatNotifications ships with the already-installed cometchat_sdk — no extra CometChat package.import 'package:cometchat_chat_uikit/cometchat_chat_uikit.dart';
// Register AFTER login, with the token you got from firebase_messaging getToken().
Future<void> registerPush(String fcmToken, String providerId) async {
await CometChatNotifications.registerPushToken(
PushPlatforms.FCM_FLUTTER_ANDROID, // FCM_FLUTTER_IOS on iOS; for a raw APNs token use APNS_FLUTTER_DEVICE / APNS_FLUTTER_VOIP (there is NO plain PushPlatforms.APNS)
providerId: providerId, // from the Dashboard provider you configured
fcmToken: fcmToken,
onSuccess: (res) {},
onError: (e) {},
);
}
// On logout — otherwise the device keeps receiving the previous user's messages.
Future<void> unregisterPush() async {
await CometChatNotifications.unregisterPushToken(onSuccess: (res) {}, onError: (e) {});
}PushPlatformsis an enum with per-platform Flutter variants — pick the one matching the running platform and the token type (fcmTokenvsdeviceTokenvsvoipToken). Do not pass an FCM token as adeviceToken.
onTokenRefresh and re-register, or delivery silently stops days later.CometChatUIKit.logout() — otherwise the next user of that device receives the previous user's notifications. This is a privacy bug, not just a nuisance.On a REAL device: permission granted → the token registers after login (no error) → background the app → a message from another user produces a notification → tapping it opens the app → logging out stops delivery to that device. Nothing arriving with a clean client almost always means the Dashboard provider or the platform credential (APNs key / google-services.json), not your Dart.
Live delivery is a manual device check — it cannot be automated here. Say so honestly rather than claiming verification you did not do.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.