Flutter Security

For a Play Store release build, I’d take these security steps:

- Build the app in release mode with obfuscation enabled, for example:
  `flutter build appbundle --release --obfuscate --split-debug-info=./symbols`
- Keep API keys, tokens, and other secrets out of Dart source. Inject them with `--dart-define` or a secure environment mechanism.
- Make sure sensitive data like auth tokens, refresh tokens, and PII are stored in `flutter_secure_storage`, not `shared_preferences`.
- Remove or mask any logs containing emails, phone numbers, tokens, or other user data before release.
- If the app handles high-risk data or financial flows, add SSL certificate pinning to reduce MITM risk.
- For sensitive apps, add root/jailbreak detection to make abuse harder on compromised devices.
- Treat obfuscation as a deterrent only; move truly sensitive business logic and secret-handling to the backend.

In short: no hardcoded secrets, no sensitive data in insecure local storage, no PII in logs, and ship an obfuscated release build with stronger protections like pinning or jailbreak detection when the app’s risk level justifies it.