flutter-securitylisted

# Flutter Security Protect user data and privileged operations with controls that match the actual threat model. Treat code, configuration, storage, logs, and binaries shipped to a user-controlled device as inspectable. ## Establish scope 1. Identify protected assets, actors, trust boundaries, supported platforms, sensitive flows, and realistic abuse cases. 2. Inspect `pubspec.yaml`, `pubspec.lock`, platform manifests and entitlements, environment handling, network configuration, storage, logging, WebViews, links, and release settings relevant to those assets. 3. Distinguish public identifiers from credentials and server-enforced trust. Do not label every client-visible key a secret without checking its provider contract and allowed restrictions. 4. Define whether the work is a static review, hardening change, or authorized runtime assessment. Do not probe external systems, rotate credentials, revoke sessions, or change production policy without explicit authorization. ## Core rules - Never rely on obfuscation, environment files, or client-side checks to keep a credential secret or enforce authorization. - Minimize sensitive data collection, retention, exposure, and logging. Clear user-bound caches and credentials when their lifecycle ends. - Use platform-backed key and credential storage where the threat model requires it; ordinary preferences and databases are not secret vaults. - Keep authentication state in the client, but enforce authorization and sensitive business