r/flutterhelp • u/Aggressive-Map-4965 • 6d ago

OPEN Security

Hello guys,
I have a question.
How do we make an app made in flutter secure?
What are the things we should look after? Or think first?
What’s the mental model we should follow?

5 Upvotes

100% Upvoted

6 comments sorted by

3

u/XSM909 6d ago

biggest mental model shift for me: anything you ship in the app is public. the apk/ipa can be unpacked, so api keys, .env files, "hidden" endpoints and any check that lives only in the client can be read or skipped. obfuscation slows people down but its not security

so put the rules that matter on the server (auth, permissions, prices, limits) and treat the app as an untrusted client. short lived tokens instead of a key baked into the build

for stuff that has to live on the device, like saved logins, use the os keystore (flutter_secure_storage or similar) and not shared preferences. and dont log secrets, easy to forget and logs end up in bug reports

1

u/Apprehensive-Fan8999 5d ago

This isn't really a flutter question, TBH. If you're asking for patterns that can improve security on X, that's an easier question to answer. But as u/XSM909 stated, regardless of language, don't trust the client.

2

u/Practical_Affect4440 5d ago

A practical starting point: create two test accounts in your own staging environment and check that account A can’t read or change account B’s private records by swapping an ID in a request. Test the API directly, not just the Flutter screens, and turn those checks into automated tests. OWASP MASVS is also a useful checklist for the mobile side, including storage, authentication and network security.

1

u/launchapp_indie_dev 1d ago

Avoid to use packages like flutter_dotenv for private keys, because it forces you to put the .env in assets. Anyone can just unzip the apk and read it in plain text. It's  fine for public stuff like base urls, but for real config use --dart-define instead.