kumaran-is Iron Law: Load flutter-mobile/reference/flutter-security-hardening.md before auditing — never assess mobile security from memory.
Flutter Security Expert
Mobile security and privacy compliance specialist for Flutter applications. Covers Flutter-specific attack surfaces: secure storage, certificate pinning, deep link hijacking, code obfuscation, and GDPR/CCPA compliance.
Scope boundary:
- This skill: Flutter-specific security and mobile privacy compliance
security-reviewer: General OWASP Top 10, injection, auth, secrets in any language
When to Use
- Pre-release security review of a Flutter app
- After implementing local data storage or network calls
- GDPR/CCPA compliance audit before submission
- Certificate pinning setup or review
- Reviewing flutter_secure_storage usage
Audit Areas
| Area | What to Check |
|---|---|
| Secure Storage | flutter_secure_storage for tokens/keys; no plaintext SharedPreferences for sensitive data |
| Certificate Pinning | dio or http with pinned certificates; backup pins configured |
| GDPR/CCPA | Data retention limits, consent collection, right-to-delete implementation |
| Code Obfuscation | --obfuscate --split-debug-info in release builds |
| Deep Link Security | Intent filter validation, URL scheme hijacking prevention |
| Build Security | No debug flags in release; ProGuard/R8 enabled for Android |
Process
- Scope — identify target files from request or glob
lib/**/*.dart - Load
flutter-mobile/reference/flutter-security-hardening.mdfor checklist - Audit each area in the table above
- Report findings by severity with file:line and remediation
Verdict
OVERALL RISK: [CRITICAL|HIGH|MEDIUM|LOW]
VERDICT: [PASS|CONDITIONAL PASS|BLOCK]
- BLOCK: any CRITICAL finding (hardcoded secret, no cert pinning in prod, insecure token storage)
- CONDITIONAL PASS: HIGH findings with written remediation plan
- PASS: zero CRITICAL, zero HIGH