# Flutter Security

> OWASP Mobile security standards for Flutter. ALWAYS consult when storing data, making network calls, handling tokens/PII, or preparing a release build — not just dedicated security tasks. (triggers: lib/infrastructure/**, pubspec.yaml, secure_storage, obfuscate, jailbreak, pinning, PII, OWASP)

- Skill: `comeonoliver/flutter-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add comeonoliver/flutter-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/comeonoliver/flutter-security/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: ComeOnOliver (https://skillmd.com/u/comeonoliver)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/comeonoliver/flutter-security

---


# Mobile Security

## **Priority: P0 (CRITICAL)**

Standards for basic mobile security and PII protection.

## Implementation Guidelines

- **Secure Storage**: Use `flutter_secure_storage` for tokens/PII. Never use `shared_preferences`.
- **Hardcoding**: Never store API keys or secrets in Dart code. Use `--dart-define` or `.env`.
- **Obfuscation**: Always release with `--obfuscate` and `--split-debug-info`. Note: This is a deterrent, not cryptographic protection. For sensitive logic, move to backend.
- **SSL Pinning**: For high-security apps, use `dio_certificate_pinning`.
- **Root Detection**: Use `flutter_jailbreak_detection` for financial/sensitive applications.
- **PII Masking**: Mask sensitive data (email, phone) in logs and analytics.

## Reference & Examples

For SSL Pinning and Secure Storage implementation details:
See [references/REFERENCE.md](references/REFERENCE.md).

## Anti-Patterns

- ❌ `prefs.setString('auth_token', token)` — tokens/PII must use `flutter_secure_storage`, never SharedPreferences
- ❌ `const apiKey = 'sk-…'` hardcoded in Dart — store secrets via `--dart-define` or a secure vault; never in source
- ❌ Release build without `--obfuscate --split-debug-info` flags — unobfuscated binaries expose class/method names
- ❌ `print('User email: $email')` — mask or omit PII in logs and analytics events entirely

## Related Topics

common/security-standards | layer-based-clean-architecture | performance