Security

Secrets in source code Use environment variables (Platform.environment), --dart-define, secret managers. Never ship server secrets in client apps (Flutter apps can be decompiled).

Flutter: flutter_secure_storage (Keychain/Keystore). Avoid storing tokens in SharedPreferences.

Always HTTPS. Certificate pinning (SecurityContext, dio adapters) for sensitive apps. Validate TLS (never disable certificate checks).

Injection (SQL/command) Parameterized queries (postgres substitution values, drift). Process.run with argument lists (no shell strings with user input).

Validate and sanitize all external input (JSON patterns, int.tryParse, length limits). Escape HTML output (HtmlEscape from dart:convert).

Use vetted packages: cryptography, pointycastle, crypto (hashing: SHA-256, HMAC). Random.secure() for tokens. Hash passwords with argon2/bcrypt implementations server-side.

Review pub.dev packages (verified publishers, scores), pin versions with pubspec.lock, keep them updated (dart pub outdated), audit them

Flutter --obfuscate --split-debug-info=build/symbols (it raises the bar but isn't true protection)

Rate limiting, CORS configuration (shelf_cors_headers), auth middleware (JWT via dart_jsonwebtoken), security headers, least-privilege containers

import 'dart:convert';
import 'package:crypto/crypto.dart';
final digest = sha256.convert(utf8.encode('message'));
final hmac = Hmac(sha256, utf8.encode('secret-key')).convert(utf8.encode('payload'));