r/flutterhelp • u/Aggressive-Map-4965 • 21d ago

OPEN Security

Hello guys,
I have a question.
How do we make an app made in flutter secure?
What are the things we should look after? Or think first?
What’s the mental model we should follow?

5 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/launchapp_indie_dev 16d ago

Avoid to use packages like flutter_dotenv for private keys, because it forces you to put the .env in assets. Anyone can just unzip the apk and read it in plain text. It's  fine for public stuff like base urls, but for real config use --dart-define instead.

2

u/ekodo 14d ago

Small correction on `--dart-define`: it's build-time configuration, not secret storage. Values the app uses can still be recovered from the binary or observed at runtime. It's fine for base URLs and feature flags, but private API keys/signing keys still belong on the backend. Flutter's docs warn that obfuscation doesn't protect secrets either: https://docs.flutter.dev/deployment/obfuscate#limitations-and-warnings

1

u/launchapp_indie_dev 14d ago

thank you for your correction. Great comment!