flutter-security

Flutter Security

Full reference: template.md

Key rules

Never hardcode secrets

// DON'T
const apiKey = 'sk-live-abc123'; // committed to git → leaked

// DO — load from EnvConfig, injected at build time via --dart-define
final apiKey = getIt<AppConfig>().apiKey; // reads from compile-time env

All sensitive data in SecureStorage — never SharedPreferences

// DON'T
prefs.setString('auth_token', token); // plain text, unencrypted

// DO
await getIt<SecureStorage>().write(key: StorageKeys.authToken, value: token);

Certificate pinning — flavor-configurable

// SecurityInterceptor is registered in DI and injected into buildDio
// Pins configured per flavor in EnvConfig (enableSslPinning + sslPins)
getIt.registerLazySingleton<SecurityInterceptor>(
  () => SecurityInterceptor(config: getIt<AppConfig>()),
);
// In buildDio — bypasses when enableSslPinning is false or sslPins is empty
security.apply(dio);

Use SecurityInterceptor with SHA-256 pin matching. Pins live in EnvConfig, not in the interceptor. Never disable in prod.

Strip sensitive data from logs

// In LoggingInterceptor — redact before logging
String _redact(String body) => body
    .replaceAll(RegExp(r'"password"\s*:\s*"[^"]*"'), '"password":"[REDACTED]"')
    .replaceAll(RegExp(r'"token"\s*:\s*"[^"]*"'), '"token":"[REDACTED]"');

Obfuscate every release build

flutter build apk --release --obfuscate --split-debug-info=build/debug-info
flutter build ipa --release --obfuscate --split-debug-info=build/debug-info

Never ship a release build without --obfuscate.

Validate deep links — never trust the URI blindly

// In GoRouter redirect
if (uri.host != 'app.yourdomain.com') return '/';

Screenshot prevention (sensitive screens)

// Android: in MainActivity.kt
window.setFlags(WindowManager.LayoutParams.FLAG_SECURE,
                WindowManager.LayoutParams.FLAG_SECURE)

// Flutter side — call via MethodChannel wrapper
getIt<ScreenSecurityService>().enableSecureMode();