Securing Flutter Apps
summary
Claims that 75% fail basic security tests and that OWASP Mobile Top 10 issues mostly map to Flutter development guide the checklist: avoid over-requesting permissions, never store sensitive data unencrypted (no plaintext SharedPreferences), use flutter_secure_storage or Hive with strong encryption, protect background snapshots, enforce TLS and certificate pinning with SHA256 fingerprints, and verify auth/authorization server-side. Detect runtime tampering and jailbreaks with flutter_jailbreak_detection and consider free RASP (tokapp) for runtime hooks, fingerprint tampering and automated responses; use local_auth, crypto/encrypt packages, obfuscation/minification, and keep Flutter and libs on stable releases.
AI-written summary · about
chapters (15)
- 0:00Introduction to mobile security
- 3:06OWASP top 10 overview
- 7:22Improper platform use risks
- 9:56Insecure data storage solutions
- 13:50Insecure communication risks
- 16:40Insecure authentication methods
- 18:54Insufficient cryptography basics
- 22:57Authorization and validation
- 24:00Client code quality issues
- 25:03Code tampering threats
- 26:34Reverse engineering protection
- 28:01Redundant functionality risks
- 29:04RASP runtime protection
- 33:12Progressive security approach
- 34:58Security testing resources
related talks
43mDangerous Flutter... Or Not?
32mSecurity in Flutter: Our Priority
19mSecuring your app: Classic Android vs Other frameworks
42mHack My App: Learn Flutter Security by Breaking It
33mHacking and protection of Mobile Apps and backend APIs
45mTen Secrets to Secure Mobile Applications
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
41mCrash-Proof Flutter: Building Apps That Refuse to Die