Flutter Security

No — `SharedPreferences` is not appropriate for auth tokens. It’s fine for non-sensitive app settings, but tokens should go in secure OS-backed storage such as `flutter_secure_storage` (Keychain on iOS, Keystore on Android).

Use this instead:

```dart
final storage = FlutterSecureStorage();
await storage.write(key: 'auth_token', value: token);
final token = await storage.read(key: 'auth_token');
```

A few related security points:

- Don’t hardcode API secrets in Dart code; pass them via `--dart-define` or a secure backend flow.
- Don’t log tokens or other PII.
- For sensitive apps, consider certificate pinning and root/jailbreak detection.
- Obfuscate release builds with `--obfuscate --split-debug-info=./symbols` as a deterrent, but keep real secrets and critical logic on the backend.