Hive box opened without encryption (encryptionCipher missing)

ID

dart.storage.hive_no_encryption

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Storage

Language

Dart

Description

A Hive box is opened without an encryptionCipher: argument. Hive boxes are stored as plaintext binary on device and can be read from any backup or rooted / jailbroken device.

Rationale

Hive is a fast key-value database popular in Flutter apps. By default it stores its boxes as plaintext binary files under the app’s documents directory. The sandbox protection is the same as for SharedPreferences / plain files — and it fails in the same ways: rooted devices, OS backups, cross-device sync, forensic imaging.

If the box holds any data the user expects to be private (auth tokens, profile, message history, financial records), encrypting it is necessary. Hive supports per-box AES-CBC encryption via encryptionCipher: HiveAesCipher(keyBytes); the key bytes must themselves be stored in a secure place (typically flutter_secure_storage).

The following code illustrates a vulnerable pattern detected by this rule:

class HivePlain {
  Future<void> open() async {
    await Hive.initFlutter();
    // VULNERABLE: Hive box opened without encryption (encryptionCipher missing)
    final settings = await Hive.openBox('settings');
    // VULNERABLE: Hive box opened without encryption (encryptionCipher missing)
    final cache = await Hive.openLazyBox('cache');
    final users = await Hive.openBox<Map>('users');
    print('$settings $cache $users');
  }
}

Remediation

Generate a Hive encryption key once on first launch with Hive.generateSecureKey(), persist it in flutter_secure_storage, and pass HiveAesCipher(key) to every openBox / openLazyBox.

// Vulnerable
await Hive.openBox('settings');
await Hive.openLazyBox('cache');

// Fixed
const storage = FlutterSecureStorage();
var rawKey = await storage.read(key: 'hive_key');
if (rawKey == null) {
  final newKey = Hive.generateSecureKey();
  await storage.write(key: 'hive_key', value: base64Encode(newKey));
  rawKey = base64Encode(newKey);
}
final key = base64Decode(rawKey);
await Hive.openBox(
  'settings',
  encryptionCipher: HiveAesCipher(key),
);

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved