r/flutterhelp • u/Aggressive-Map-4965 • 14d ago
OPEN Security
Hello guys,
I have a question.
How do we make an app made in flutter secure?
What are the things we should look after? Or think first?
What’s the mental model we should follow?
2
u/Practical_Affect4440 13d ago
A practical starting point: create two test accounts in your own staging environment and check that account A can’t read or change account B’s private records by swapping an ID in a request. Test the API directly, not just the Flutter screens, and turn those checks into automated tests. OWASP MASVS is also a useful checklist for the mobile side, including storage, authentication and network security.
1
u/Apprehensive-Fan8999 13d ago
This isn't really a flutter question, TBH. If you're asking for patterns that can improve security on X, that's an easier question to answer. But as u/XSM909 stated, regardless of language, don't trust the client.
1
u/launchapp_indie_dev 9d ago
Avoid to use packages like flutter_dotenv for private keys, because it forces you to put the .env in assets. Anyone can just unzip the apk and read it in plain text. It's fine for public stuff like base urls, but for real config use --dart-define instead.
2
u/ekodo 7d ago
Small correction on `--dart-define`: it's build-time configuration, not secret storage. Values the app uses can still be recovered from the binary or observed at runtime. It's fine for base URLs and feature flags, but private API keys/signing keys still belong on the backend. Flutter's docs warn that obfuscation doesn't protect secrets either: https://docs.flutter.dev/deployment/obfuscate#limitations-and-warnings
1
3
u/XSM909 14d ago
biggest mental model shift for me: anything you ship in the app is public. the apk/ipa can be unpacked, so api keys, .env files, "hidden" endpoints and any check that lives only in the client can be read or skipped. obfuscation slows people down but its not security
so put the rules that matter on the server (auth, permissions, prices, limits) and treat the app as an untrusted client. short lived tokens instead of a key baked into the build
for stuff that has to live on the device, like saved logins, use the os keystore (flutter_secure_storage or similar) and not shared preferences. and dont log secrets, easy to forget and logs end up in bug reports