rules-kotlin

Cleartext HTTP transmits data without encryption — vulnerable to interception. Use HTTPS for all network communication. For Android, do not set cleartextTrafficPermitted.

The !! operator throws NullPointerException on null — the exact problem Kotlin's type system prevents. Use safe calls (?.), let{}, or provide a default with ?:

Hardcoded credentials in Kotlin source are embedded in the APK/JAR. Store secrets in environment variables, BuildConfig fields from a gitignored local.properties, or a secrets manager.

Java deserialization via ObjectInputStream is a known RCE vector. Use kotlinx.serialization, Gson, or Moshi for safe data serialization.

Constructing file paths from user-controlled input enables path traversal (CWE-22). Sanitize input by resolving to a canonical path and verifying it is within the expected base directory before opening the file.

Runtime.exec() or ProcessBuilder with string interpolation enables command injection. Build command arguments as a list — never concatenate user input into a command string.

String interpolation/concatenation in SQL queries enables SQL injection. Use PreparedStatement with ? placeholders or a Kotlin-aware ORM like Exposed.

Trust-all X509TrustManager disables TLS certificate validation, making TLS useless and enabling trivial MITM attacks (CWE-295). Use the system trust store or pin specific certificates with OkHttp's CertificatePinner.

Unchecked casts (as) throw ClassCastException if the type doesn't match. Use safe casts (as?) which return null on mismatch, then handle the null case explicitly.

java.util.Random is not cryptographically secure (CWE-338). Use java.security.SecureRandom for any security-sensitive value: tokens, passwords, salts, nonces, session IDs.