maalik-e-makaan

The source is in a public Git repository on GitHub that anyone can read and clone without signing in. It holds the Flutter app, the Supabase migrations and Edge Functions, the Astro website, the formal models and the CI workflows.

URL: https://github.com/ar27111994/maalik-e-makaan

Git records what changed, who made the change and when for every commit, and GitHub keeps the pull request, review and CI history for each one. After the initial commit, every change has reached main through a pull request. The project's convention is a squash merge with a Conventional Commit title, which commitlint checks in a lefthook commit-msg hook and in CI, and pr-title.yml checks the pull request title.

URL: https://github.com/ar27111994/maalik-e-makaan/commits/main

The repository holds work between releases, not only final releases. Every change is a public pull request whose individual commits and CI runs stay visible (PR #1 has 107 commits), and main already has several merged changes (#1, #13, #14) before the first release is cut by its own release pull request.

URL: https://github.com/ar27111994/maalik-e-makaan/pull/1/commits

The project uses Git, a distributed version control system, hosted on GitHub.

URL: https://github.com/ar27111994/maalik-e-makaan

Each release gets a unique version number, vX.Y.Z, from release-please, starting with v1.0.0. The release pull request writes the number into app/pubspec.yaml and website/package.json. The Release workflow builds with it (--build-name) and names each artefact with the tag, for example maalik-e-makaan-v1.0.0-web.zip.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/release-please-config.json

Each release is marked with a Git tag, vX.Y.Z (include-v-in-tag in release-please-config.json). Merging the release pull request creates the tag and the GitHub release, and the Release workflow builds and attaches that tag's artefacts with provenance attestations.

URL: https://github.com/ar27111994/maalik-e-makaan/tags

Each release has human-readable release notes: release-please writes CHANGELOG.md and the GitHub release from Conventional Commit titles, grouped by kind. The v1.0.0 notes list the release's main features (portfolios and team roles, the rent ledger, receipts, caretakers, police registration, tax-year statements, WhatsApp reminders, the bilingual app and website).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/CHANGELOG.md

No publicly known run-time vulnerability has been fixed in the project's own code: it has no CVE assignments, and its list of GitHub security advisories is empty. Vulnerabilities are reported privately through GitHub security advisories (SECURITY.md). When a release fixes a published advisory, its release notes will name the GHSA or CVE ID.

URL: https://github.com/ar27111994/maalik-e-makaan/security/policy

Bugs are reported through GitHub Issues using a structured bug-report form (what happened, steps to reproduce, where it happened, app language, app version); blank issues are turned off so reporters are guided to the form. README.md (Contributing) and CONTRIBUTING.md (Reporting problems) point to the issue forms, and the website's privacy, terms and FAQ pages link to the issue tracker.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml

The project tracks individual issues in GitHub Issues, with bug-report and feature-request forms that apply the 'bug' and 'enhancement' labels automatically; pull requests are tracked in the same place.

URL: https://github.com/ar27111994/maalik-e-makaan/issues

The repository was created on 3 November 2026 and no bug reports have been filed yet: every item in the tracker so far is a pull request, so there are no unacknowledged reports. Bug reports come in through the bug-report form, which labels them 'bug', and the maintainer will acknowledge each one.

URL: https://github.com/ar27111994/maalik-e-makaan/issues?q=is%3Aissue

No enhancement requests have been filed since the repository was created on 3 November 2026, so none are waiting for a response. Requests come in through the feature-request form, which applies the 'enhancement' label, and the maintainer will respond to each one, even if the answer is no.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/ISSUE_TEMPLATE/feature_request.yml

All issues and pull requests, open and closed, with their comments, stay publicly available and searchable in the GitHub issue tracker of this public repository.

URL: https://github.com/ar27111994/maalik-e-makaan/issues?q=

SECURITY.md, which GitHub shows as the repository's security policy, explains how to report a vulnerability: privately through GitHub security advisories, never in a public issue. It also covers what to include, response times, supported versions, scope and safe harbour. CONTRIBUTING.md and the website's privacy page (English and Urdu) link to the policy, and the issue chooser sends security reports to the private advisory form.

URL: https://github.com/ar27111994/maalik-e-makaan/security/policy

Private reports are supported: GitHub private vulnerability reporting is turned on for the repository, and SECURITY.md links directly to the private advisory form (security/advisories/new). Reports sent there go over HTTPS, and only the reporter and the repository's maintainers can see them. The issue chooser also sends security reports to this form, not to a public issue.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/SECURITY.md

No vulnerability reports have been received in the last 6 months: the repository has no security advisories in any state (triage, draft, published or closed), and it dates from November 2026. SECURITY.md commits to acknowledging a report within 3 working days, well inside the 14-day limit.

URL: https://github.com/ar27111994/maalik-e-makaan/security/advisories

Every deliverable is rebuilt from source by scripted commands: the root Makefile's make build-web-app (Flutter web release) and make build-apk (Android), npm run build in website/ (Astro), and flutter build ios for the unsigned iOS app. CI rebuilds all of them on every push and pull request (the web-build, android-build, ios-build and website jobs in ci.yml).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

The build uses common, standard tools: GNU Make as the single entry point, the Flutter/Dart CLI for the app and packages, npm scripts with Astro for the website, and Deno tasks for the Edge Functions.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

The web app, website, Edge Functions, and database build and test with FLOSS tools only: Make, Flutter and Dart (BSD-3), Node, Astro, Deno, PostgreSQL and Python. Two native builds are exceptions. The Android APK uses Google's prebuilt Android SDK, which is released under Google's SDK licence, and the optional iOS build needs Apple's Xcode.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/CONTRIBUTING.md

The repository includes its automated test suites under the MIT licence: Dart unit, widget and golden tests; 21 pgTAP database suites and concurrency scenarios; Deno Edge Function tests; Vitest and Playwright website tests; Playwright browser UAT; and Python tooling tests. README.md and CONTRIBUTING.md document Make test and the per-area targets, and ci.yml runs them.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/README.md

Make test runs every fast suite. Each area also has its own target (make test-core, test-app, test-db, test-functions, test-web, test-uat), and these targets call each language's standard runner (dart test, flutter test, deno task test, npm test with Vitest, python -m unittest).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

Coverage gates in CI enforce high coverage: 100% line coverage for the mm_core domain library, 100% of lines, branches and functions for the Edge Functions, 95% of lines for the mm_ui design system and 90% for the app. Twenty-one pgTAP suites cover the database, including an RLS matrix and contract vectors shared with Dart. The website's Vitest and Playwright suites run in CI but have no numeric coverage gate.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

GitHub Actions CI (ci.yml) runs on every push to main, on every pull request and in the merge queue. It runs formatting, linting, and analysis; every test suite with its coverage gate, pgTAP on PostgreSQL and on a full Supabase stack; Edge Function end-to-end tests; browser UAT; formal-model checks; and release builds. A single "CI passed" check, which needs every job, gates merges.

URL: https://github.com/ar27111994/maalik-e-makaan/actions/workflows/ci.yml

The policy is that new or changed functionality comes with automated tests. The pull request template requires "Tests cover the change, including edge cases and failure paths", and CONTRIBUTING.md requires pgTAP tests (and concurrency scenarios) for database changes. In the Dart packages, the app and the Edge Functions, CI's coverage gates also fail a change that adds code without tests.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/pull_request_template.md

Recent major changes added tests along with the code. The v1.0 pull request (#1) shipped the app, backend and website with their unit, widget, golden, pgTAP, Edge Function, website and UAT suites. The iOS packaging change (#14) added tool/ios/test_package_unsigned_ipa.py next to the new script and updated the UAT journeys.

URL: https://github.com/ar27111994/maalik-e-makaan/pull/14

Every change proposal fills in the pull request template, which says "Tests cover the change, including edge cases and failure paths". CONTRIBUTING.md requires pgTAP tests and concurrency scenarios for database changes, and docs/agents/workflows.md lists the tests to add for each kind of change.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/pull_request_template.md

Each language has a linter or a strict mode enabled. Dart and Flutter use very_good_analysis with strict-casts, strict-inference and strict-raw-types. The website uses TypeScript (Astro's strictest config), ESLint (typescript-eslint strictTypeChecked, jsx-a11y) and Stylelint. Edge Functions use Deno strict mode and deno lint, Python uses ruff, shell uses shellcheck, workflows use actionlint and migrations use squawk.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/app/analysis_options.yaml

Any warning fails CI, so warnings are fixed before a change merges: analyze --fatal-infos for Dart, --max-warnings=0 for ESLint and Stylelint, and deno lint, ruff and shellcheck all as gates. About 40 suppression comments are left outside generated code, each naming the specific rule and most giving a reason; 14 are reviewed squawk ignores in a single migration. ESLint reports unused disable directives as errors.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/ci.yml

The analysers run at maximum or near-maximum strictness. Info-level Dart diagnostics are fatal under very_good_analysis plus the strict language modes, and TypeScript uses Astro's strictest config with typescript-eslint strictTypeChecked and stylisticTypeChecked. Deno runs with strict and noUncheckedIndexedAccess plus extra lint rules (eqeqeq, no-non-null-assertion), and ruff enables bugbear, bandit security checks and other rule sets.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/website/eslint.config.js

The project's only developer is its primary developer, and the design is recorded in docs/architecture/permissions.md. All authorisation is enforced in one place, the database, so every request is checked whichever client sends it (economy of mechanism, complete mediation). Access is denied by default: every table has row-level security and the anon role holds no privilege on any relation, which pgTAP checks in supabase/tests/database/01_schema_security.test.sql (fail-safe defaults). Clients hold only the publishable key, and column grants keep system-owned columns unwritable (least privilege). Supabase Auth offers TOTP multi-factor sign-in (separation of privilege). Stored values and invitation tokens must match allowlist formats (CHECK constraints and regular expressions). The design is public and depends only on keys and per-invitation random secrets (open design).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/docs/architecture/permissions.md

The project counters the common errors for a web and mobile app on a database API, as its code and docs show. Missing authorisation: row-level security on every table, tested by the pgTAP RLS matrix (03_rls_matrix.test.sql). SQL injection: parameterised PostgREST and RPC calls, and every function pins search_path. Cross-site scripting: a strict Content-Security-Policy without inline scripts (website/vercel.json, docs/operations.md). Leaked secrets: the app refuses a secret key, and gitleaks scans the history in CI. Timing attacks: tokens are compared in constant time. Brute force: rate limits per user and per action. CSV formula injection: exported cells are guarded (app/lib/src/features/insights/presentation/csv.dart). CodeQL runs its security-and-quality queries on every change.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/SECURITY.md

The project uses only published algorithms and protocols that experts have reviewed. These are SHA-256 and HMAC-SHA-256 through Web Crypto in the Edge Functions (supabase/functions/_shared/crypto.ts), PostgreSQL's built-in sha256() and pgcrypto's gen_random_bytes in the database, and bcrypt in Supabase Auth. JWTs are checked against the project's JWKS by Supabase's own library (@supabase/server). All transport is TLS (HTTPS), provided by Supabase and Vercel.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/functions/_shared/crypto.ts

The project implements no cryptographic primitive of its own. It calls Web Crypto (crypto.subtle) in the Edge Functions and PostgreSQL's sha256() and pgcrypto's gen_random_bytes in the database. Its own crypto-related code is only a constant-time comparison of digests. Passwords, sessions and JWT signing are handled by Supabase Auth, and TLS by Supabase and Vercel.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/functions/_shared/crypto.ts

Everything that depends on cryptography is free and open-source software. That includes Deno's Web Crypto, PostgreSQL with pgcrypto, Supabase Auth (GoTrue, MIT licence) with bcrypt, the Dart SDK, age for encrypted backups, and standard TLS. No proprietary or patent-encumbered algorithm is needed.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/functions/_shared/crypto.ts

The project's own mechanisms use fixed sizes above the NIST 2030 minimums, and none can be set smaller. Invitation secrets are 256 random bits from gen_random_bytes(32), stored as SHA-256 (supabase/migrations/20261108082804_invitation_findings.sql). Comparisons and digests use HMAC-SHA-256 and SHA-256. The Edge Functions refuse an operator-set bearer token shorter than 32 characters (MIN_TOKEN_LENGTH in supabase/functions/_shared/config.ts). TLS and JWT signing keys are managed by Supabase and Vercel.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/migrations/20261108082804_invitation_findings.sql

No security mechanism uses MD4, MD5, single DES, RC4, Dual_EC_DRBG or an unsuitable cipher mode. Hashes are SHA-256 and MACs are HMAC-SHA-256. The backup workflow (.github/workflows/backup.yml) encrypts with age, which uses ChaCha20-Poly1305 authenticated encryption. MD5 appears only in tool/db/schema_fingerprint.sql, which compares schema definitions to detect drift. It is not a security control.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/functions/_shared/crypto.ts

The default mechanisms use neither SHA-1 nor CBC mode in SSH. They use SHA-256, HMAC-SHA-256 and 256-bit random secrets, age (ChaCha20-Poly1305) for encrypted backups; and the TLS provided by Supabase and Vercel.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/functions/_shared/crypto.ts

The software implements no key-agreement protocol of its own. All traffic is HTTPS, terminated by Vercel (website and web app) and Supabase (API, Auth, Storage). The app refuses a Supabase or app URL that is not HTTPS, except for loopback addresses in local development (app/lib/src/config/app_config.dart).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/app/lib/src/config/app_config.dart

The project does not hash passwords itself. Sign-in uses Supabase Auth (GoTrue), which stores each password as a bcrypt hash with a per-user salt. supabase/config.toml requires passwords of at least 10 characters with upper-case and lower-case letters and digits, and enables TOTP multi-factor authentication. The local demo seed also stores its demo password with crypt(..., gen_salt('bf')).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/config.toml

Every secret is generated by a cryptographically secure generator. Invitation verifiers come from pgcrypto's gen_random_bytes(32), and the Edge Functions create HMAC keys with crypto.subtle.generateKey. Identifiers are also drawn from secure sources: Dart's Random.secure in the app (app/lib/src/data/ids.dart) and crypto.randomUUID or gen_random_uuid elsewhere. Seeded Random appears only in tests, and Math.random only in a browser test script, where it makes up a path that does not exist.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/migrations/20261108082804_invitation_findings.sql

GitHub delivers the source over HTTPS or SSH. The website and web app are served over HTTPS on Vercel with HSTS (website/vercel.json, tool/web/package_vercel.py). For each release, starting with v1.0.0, release.yml uploads the builds to GitHub Releases over HTTPS. It adds a SHA256SUMS file and a Sigstore-signed build provenance attestation (actions/attest-build-provenance), which gh attestation verify can check.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/release.yml

No hash is fetched over plain HTTP. Checksums for downloaded tools are pinned in the repository and checked after an HTTPS download: gitleaks in security.yml, and the formal toolchain in tool/formal/install.sh, which uses curl --proto '=https' --tlsv1.2. Release SHA256SUMS files are served over HTTPS next to a signed provenance attestation.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/security.yml

No vulnerability has been reported or published against the project: it has no security advisories and no CVEs, and the repository is less than 60 days old (first commit on 3 November 2026). Private vulnerability reporting is enabled. OSV-Scanner checks every lockfile on each change and weekly; Dependabot keeps dependencies current, and the Security workflow passes on main.

URL: https://github.com/ar27111994/maalik-e-makaan/security/policy

SECURITY.md commits to acknowledging a report within 3 working days and assessing its severity within 10 working days. It also says confirmed issues are fixed before anything else, and that only the latest release and main receive fixes. No critical vulnerability has been reported so far.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/SECURITY.md

The repository contains no working credential. Gitleaks scans the whole history on every change (security.yml). Its allowlist (.gitleaks.toml) admits only three named fake test-fixture values, and only inside test directories. The only other credential is the demo password in supabase/seed.sql, which is for local development and CI only and is never applied to the hosted project. Real secrets live in the GitHub, Supabase and Vercel secret stores. The two committed .env.example files hold only URLs, no secrets.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.gitleaks.toml

Every pull request and every push to main runs CodeQL with the security-and-quality queries on the TypeScript/JavaScript (website and Edge Functions) and on the GitHub Actions workflows, and zizmor on the workflows (.github/workflows/security.yml), so the commit each release is tagged from has been analysed. CI also runs the Dart analyzer with very_good_analysis and --fatal-infos, deno lint, ESLint with typescript-eslint strictTypeChecked and --max-warnings=0, plpgsql_check (supabase db lint --fail-on error), squawk on new migrations, ruff, shellcheck and actionlint (.github/workflows/ci.yml; Makefile targets analyze and lint). Dart has no CodeQL extractor, so the Dart code is covered by the analyzer rules and the tests.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/security.yml

CodeQL runs its security-and-quality query suite, which includes the security (CWE) queries for JavaScript/TypeScript, such as injection and cross-site scripting, and for GitHub Actions, such as code injection and untrusted checkout. Zizmor audits the workflows for known Actions vulnerability patterns, and Gitleaks scans the whole Git history for leaked secrets (.github/workflows/security.yml).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/security.yml

CodeQL and zizmor send their results to GitHub code scanning on every pull request and push to main, and the CI analyzers block merging on any finding through the required "CI passed" check (--fatal-infos, --max-warnings=0, plpgsql_check --fail-on error). Confirmed security issues are fixed before other work, as SECURITY.md says, and no medium or higher static-analysis finding is open.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/security.yml

The Security workflow (CodeQL, zizmor, gitleaks, OSV-Scanner) runs on every push to main, on every pull request and weekly on a schedule (.github/workflows/security.yml). The CI workflow runs the analyzers and linters on every pull request and every push to main, and "CI passed" is the required check for merging (.github/workflows/ci.yml).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/security.yml

CI runs on every pull request and every push to main, so before each release it runs test suites that execute the code with varied inputs. The Edge Function tests must reach 100% line, branch and function coverage (make test-functions). Seeded randomised property tests run thousands of cases on the money and rent arithmetic in mm_core (money_test.dart, allocation_test.dart) and on the website (tests/unit/money.test.ts, rent-math.test.ts). tool/db/concurrency_test.sh runs 30 parallel race scenarios on real PostgreSQL and then checks the ledger and ownership invariants. Playwright UAT takes the built web app through every user journey on a local Supabase stack, and the website's Playwright tests run axe. fast-check property tests are being added to the website.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/tool/db/concurrency_test.sh

The software the project releases is written in memory-safe languages: Dart (the app and packages), TypeScript (the Edge Functions and website) and SQL/PL/pgSQL, with small amounts of Kotlin and Swift platform glue. The only C/C++ in the repository is Flutter's generated Linux desktop runners (app/linux/runner and packages/mm_ui/example/linux/runner), which are used only to run tests locally and are never built for release. Releases contain only the Android, iOS and web builds (.github/workflows/release.yml).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/release.yml

The Dart and Flutter tests (dart test, flutter test in the Makefile) run in debug mode with assertions on. This enables the assert() checks in mm_ui and the app, and Flutter's own framework assertions, and release builds strip them. mm_core checks its arguments with exceptions that are always on (ArgumentError). Each scenario in tool/db/concurrency_test.sh checks its own expected outcome, and the run ends by checking the ledger and ownership invariants.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

No medium or higher exploitable vulnerability found by dynamic analysis is open. A failing test blocks merging through the required "CI passed" check. Races found before 1.0.0 were fixed by new migrations, for example, supabase/migrations/20261105170557_concurrency_findings.sql (a race could leave a document without its file, and writes are now authorised again after taking the lock). Each fix has a regression scenario in tool/db/concurrency_test.sh that fails without it.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/supabase/migrations/20261105170557_concurrency_findings.sql