Inventory what the client contains
Review Dart constants, bundled assets, Android resources, native plugins and generated configuration. A secret moved from Dart to a native library is still shipped to the user.
The Flutter obfuscation guide states the scope of its protection. Use Android security guidance for platform storage, networking and component exposure.
Separate identifiers from credentials
| Value | Appropriate treatment |
|---|---|
| Public project identifier | Validate configuration and backend controls |
| User session token | Minimize exposure and use appropriate storage/lifetime |
| Service-account private key | Keep off the client entirely |
| Third-party privileged API key | Move privileged operation behind controlled backend access |
A scan finding a string is a reason to classify it, not automatically a confirmed vulnerability.
Review plugins as native code
A Flutter package can add Android permissions, services, providers and SDK behavior. Inspect the merged manifest and actual dependency inventory rather than reviewing only Dart source.
Remove unused plugins and verify the current publisher, maintenance state and documented data handling of retained dependencies.
Test boundaries, not only screens
Test unauthorized requests, another user's resource ID, revoked permission, expired token and invalid input. A polished UI can still call an overly permissive backend.
Keep logs and crash reports free of tokens and private content. Debug conveniences should not silently survive into the release variant.
Preserve release diagnostics
Archive obfuscation symbols and native symbols where applicable, then verify readable crash diagnostics from an optimized test release.
APKLint's Flutter APK Analyzer and security tools can support package inspection. They do not prove backend authorization, runtime behavior or resistance to every attack. A useful audit ends with specific verified controls and clearly scoped unresolved risks, not a single “secure APK” label.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
