Flutter Security

Mobile Security

Priority: P0 (CRITICAL)

Standards for basic mobile security and PII protection.

Implementation Guidelines

• Secure Storage: Use flutter_secure_storage for tokens/PII. Never use shared_preferences.
• Hardcoding: Never store API keys or secrets in Dart code. Use --dart-define or .env.
• Obfuscation: Always release with --obfuscate and --split-debug-info. Note: This is a deterrent, not cryptographic protection. For sensitive logic, move to backend.
• SSL Pinning: For high-security apps, use dio_certificate_pinning.
• Root Detection: Use flutter_jailbreak_detection for financial/sensitive applications.
• PII Masking: Mask sensitive data (email, phone) in logs and analytics.

Reference & Examples

For SSL Pinning and Secure Storage implementation details: See references/REFERENCE.md.

Anti-Patterns

• ❌ prefs.setString('auth_token', token) — tokens/PII must use flutter_secure_storage, never SharedPreferences
• ❌ const apiKey = 'sk-…' hardcoded in Dart — store secrets via --dart-define or a secure vault; never in source
• ❌ Release build without --obfuscate --split-debug-info flags — unobfuscated binaries expose class/method names
• ❌ print('User email: $email') — mask or omit PII in logs and analytics events entirely

Related Topics

common/security-standards | layer-based-clean-architecture | performance