Flutter Security

Protect user data and privileged operations with controls that match the actual threat model. Treat code, configuration, storage, logs, and binaries shipped to a user-controlled device as inspectable.

Establish scope

1. Identify protected assets, actors, trust boundaries, supported platforms, sensitive flows, and realistic abuse cases.
2. Inspect pubspec.yaml, pubspec.lock, platform manifests and entitlements, environment handling, network configuration, storage, logging, WebViews, links, and release settings relevant to those assets.
3. Distinguish public identifiers from credentials and server-enforced trust. Do not label every client-visible key a secret without checking its provider contract and allowed restrictions.
4. Define whether the work is a static review, hardening change, or authorized runtime assessment. Do not probe external systems, rotate credentials, revoke sessions, or change production policy without explicit authorization.

Core rules