Disclaimer: The plugin's dev has put a lot of work into it, so I don't wanna talk bad about the plugin!! I'm only working in IT since 2 years and from his Github profile he seems way more experienced, so don't take this as any argument against this plugin. I just want to know in general, how can you make sure that a 3rd party plugin is safe?
Question: How can I ensure that this plugin
https://pub.dev/packages/veridflutterplugin is not made by a hacker with bad intention?
If I read to all files in the plugins code: https://github.com/AppliedRecognition/Ver-ID-Flutter and if I don't find any suspicious line of code there + if I compile the code by myself and add it to my project directly -> can I then be sure that the plugin is safe??
With the plugin I could let the users of my app scan an ID or passport + take a selfie and compare the faces of the ID and the selfie to get the user's data and verify the user. This is really awesome and exactly what I need for my app where user's are allowed to rent out items and where I need to have their real identity in case the item gets damaged or stolen.
I fear that if this plugin was written with bad intention the creator could get all my users' ID infos + their selfies, e.g. by sending the info from my app to their server without me noticing, which would enable the plugin/the dev to authenticate at other online services that also use the ID + selfie authentication process, e.g. https://shuftipro.com/document-verification
There are some things that I find a bit suspicious about the plugin:
- it has 0 stars on pub.dev
- the website linked on the pub.dev site doesn't work / gets blocked by my browser bc unsecure: appliedrec.com/
- to use the plugin you need to authorize the plugin developer to "Act on your behalve" on your github account: