Security & Privacy

When to use

• •Storing or reading tokens/credentials/session data.
• •Logging user actions, errors, or request context.
• •Persisting any user-identifiable data.
• •Implementing auth flows or “remember me”.

Steps

1) Classify the data first

Treat as sensitive unless proven otherwise:

• •secrets: tokens, API keys, credentials, session IDs
• •PII: emails, phones, names, addresses, document numbers
• •payloads: request/response bodies may contain secrets or PII

2) Apply OWASP baseline for sensitive features

For auth, storage, and network-heavy changes, validate decisions against:

• •OWASP Mobile Top 10 (threat categories)
• •OWASP MASVS/MAS checklist (implementation verification)

Document threat assumptions and chosen mitigations in PR notes or docs.

3) Store secrets only in flutter_secure_storage

Never store secrets in SharedPreferences, Drift, or plain files.

Use a wrapper interface so it is mockable:

abstract interface class ISecureStorage {
  Future<void> write({required String key, required String value});
  Future<String?> read({required String key});
  Future<void> delete({required String key});
}

Inject ISecureStorage via DependenciesContainer and use it in repositories/datasources.

4) Keep auth and storage testable

Test security behavior with fakes:

• •fake secure storage (in-memory map)
• •fake repositories/clients

Example fake:

final class InMemorySecureStorage implements ISecureStorage {
  final _store = <String, String>{};

  @override
  Future<void> write({required String key, required String value}) async {
    _store[key] = value;
  }

  @override
  Future<String?> read({required String key}) async => _store[key];

  @override
  Future<void> delete({required String key}) async {
    _store.remove(key);
  }
}

5) Prefer least-privilege data flow

• •UI reads only what it needs (selectors/scopes).
• •Avoid passing tokens through widget trees.
• •Keep sensitive operations inside repositories/datasources.

6) Verify supply-chain and transport safety

• •Screen new dependencies for maintenance and known vulnerabilities before adoption.
• •Use HTTPS/TLS only for production traffic; never allow plaintext transport in release flows.