Flutter is an amazing framework for rapid, beautiful cross-platform development, but along with rapid improvement in technology, the number of people using technology for unethical purposes is increasing as well, and hence, modern apps without proper security measures are a disaster waiting to happen. The image below is OWASP’s Top 10 Mobile App Risks OWASP’s Top 10 Mobile App Risks In this article, we’ll look at different ways Flutter developers can enhance their app’s security and cover security risks mentioned in the OWASP report. Flutter 1. Protect Your Code from Reverse Engineering Although Flutter compiles Dart code into native libraries but skilled hackers can still manage to reverse engineer your code and extract private secrets. To protect against this, follow these guidelines: Enable Dart Obfuscation: Enable Dart Obfuscation: Secure your code from reverse engineering using --obfuscate flag, Your build command should look like this: flutter build apk --obfuscate --obfuscate flutter build apk --obfuscate Use ProGuard/R8 for Android: Use ProGuard/R8 for Android: Add ProGuard rules to shrink and obfuscate the Java/Kotlin side. Strip Debug Symbols on iOS, in Xcode: set Strip Debug Symbols During Copy to Yes. Add ProGuard rules to shrink and obfuscate the Java/Kotlin side. Strip Debug Symbols on iOS, in Xcode: set Strip Debug Symbols During Copy to Yes. Strip Debug Symbols During Copy Yes 2. Secure API Communication Use HTTPS: Use HTTPS: Make sure to use https instead of http, as http is prone to packet interception and consumers’ sensitive info is easily accessible over the network. https http, http Use SSL Pinning: Use SSL Pinning: Make sure to pin the SSL certificate for secure communication and TSL handshake. The following is an example of SSL pinning using dio package in Flutter: dio Future<Dio> createPinnedDio() async { final dio = Dio(); // Load your pinned certificate (PEM) final certBytes = (await rootBundle.load('assets/cert/my_cert.pem')) .buffer .asUint8List(); dio.httpClientAdapter = IOHttpClientAdapter( createHttpClient: () { final sc = SecurityContext(withTrustedRoots: false); sc.setTrustedCertificatesBytes(certBytes); return HttpClient(context: sc) ..badCertificateCallback = (X509Certificate cert, String host, int port) { // Optional extra validation return host == "your.api.domain.com"; }; }, ); return dio; } Future<Dio> createPinnedDio() async { final dio = Dio(); // Load your pinned certificate (PEM) final certBytes = (await rootBundle.load('assets/cert/my_cert.pem')) .buffer .asUint8List(); dio.httpClientAdapter = IOHttpClientAdapter( createHttpClient: () { final sc = SecurityContext(withTrustedRoots: false); sc.setTrustedCertificatesBytes(certBytes); return HttpClient(context: sc) ..badCertificateCallback = (X509Certificate cert, String host, int port) { // Optional extra validation return host == "your.api.domain.com"; }; }, ); return dio; } 3. Secure Sensitive Storage Storing your secrets, such as tokens, in shared preferences is risky because they are stored as plain text. Instead, use secure alternatives like flutter_secure_storage (which stores data in the iOS keychain and Android keystore) or encrypt your local database using SQLCipher. This way, even if the database is accessed after a successful reverse engineering attempt, the data will remain encrypted and therefore useless to hackers. flutter_secure_storage 4. Handle Authentication Properly Relying only on storing tokens locally is not good enough; use more robust approaches like those below: OAuth2.0 implementation Add refresh token mechanism Add token expiry from server and handle in the app side Clear all local storage on logout and revoke token on the server OAuth2.0 implementation Add refresh token mechanism Add token expiry from server and handle in the app side Clear all local storage on logout and revoke token on the server 5. Never Include Secrets in Code Avoid hardcoding your API secrets into the Dart code, as they can be misused or abused if accessed by malicious actors (aka hackers). Instead, use cleaner and more professional approaches, such as: Keep secrets on the server as much as possible. Use .env files for storing configuration variables and sensitive information. Move third-party API calls from the app to the server — this will not only improve app speed but also enhance security. Keep secrets on the server as much as possible. Use .env files for storing configuration variables and sensitive information. .env Move third-party API calls from the app to the server — this will not only improve app speed but also enhance security. 6. Shield Against UI Spoofing / Tapjacking Hackers might add malicious UI overlays onto your apps that might not be visible to users, and end up gaining access to user credentials and other sensitive information. Consider protecting your app against tapjacking using the following approaches: Android Protection: Android Protection: <application android:filterTouchesWhenObscured="true" .../> <application android:filterTouchesWhenObscured="true" .../> iOS Protection: iOS Protection: iOS does not expose any API like filterTouchesWhenObscured that allows tapjacking overlays so no need to take additional protective steps against tapjacking on iOS filterTouchesWhenObscured Flutter Protection: Flutter Protection: SystemChrome.setEnabledSystemUIMode(SystemUiMode.manual, overlays: []); SystemChrome.setEnabledSystemUIMode(SystemUiMode.manual, overlays: []); 7. Use Reliable Root/Jailbreak Detection Packages Make sure to check for jailbroken devices, as they have unrestricted access to system files and make it easy to access sensitive app information. There are a variety of packages that can be found on pub.dev for this purpose. The following is an example using root_jailbreak_detector package: pub.dev root_jailbreak_detector final _rootJailbreakDetectorPlugin = RootJailbreakDetector(); try { if (Platform.isAndroid) { root = await _rootJailbreakDetectorPlugin.isRooted() ?? false; } else if (Platform.isIOS) { jailbreak = await _rootJailbreakDetectorPlugin.isJailbreaked() ?? false; } } on PlatformException { root = false; jailbreak = false; } final _rootJailbreakDetectorPlugin = RootJailbreakDetector(); try { if (Platform.isAndroid) { root = await _rootJailbreakDetectorPlugin.isRooted() ?? false; } else if (Platform.isIOS) { jailbreak = await _rootJailbreakDetectorPlugin.isJailbreaked() ?? false; } } on PlatformException { root = false; jailbreak = false; } 8. Keep Dependencies Secure Outdated and unmaintained packages can expose your app to vulnerabilities. Make sure to keep your packages up to date by running dart pub outdated and dart pub upgrade regularly to protect against as many vulnerabilities as possible. Also, make sure to remove any unused packages, and when adding a new one, make sure it has an active maintainer. dart pub outdated dart pub upgrade 9. Frontend Validations Do not just rely on backend validations; always add app-side validations as in case of a bug in an API, your app will still have secured data entry and inputs. 10. Security is a Process, Not a Patch Technology evolves with time, so do the threats. Pro habit: Pro habit: Audit your app every 6 months. Stay updated with Flutter security advisories. Audit your app every 6 months. Stay updated with Flutter security advisories. Final Thoughts — Why “Pro-Level” Security Matters In 2025, cross-platform apps are valuable for consumers and attractive targets for malicious actors. The Flutter framework gives developers a powerful toolkit, but without proper security measures, it can quickly become a liability, especially when data and information are the new gold in the tech industry. Implementing even half of the measures above will make your app more secure than most Flutter apps available publicly. If your app handles anything sensitive — financial, personal, or proprietary — these steps aren’t optional; they’re essential.
