mcpField
F
flutter-security

flutter-security

github.com/dhruvanbhalaraSecurity30333 installsUpdated 8w ago
Repository

About flutter-security

flutter-security is a Flutter development skill defining practices for protecting sensitive data and securing inputs and API communication. It guides teams implementing local storage, authentication gates, and secret handling.

Key features

  1. 01AES-256-GCM encryption for sensitive storage
  2. 02Secure key storage with flutter_secure_storage
  3. 03Argon2id master-password derivation
  4. 04Clear secrets from memory and clipboard
  5. 05Biometric checks and security audit logging
  6. 06Input validation and HTTPS-only APIs

Use cases

  1. 01Protect locally stored sensitive data
  2. 02Build biometric gates for exports and destructive actions
  3. 03Reduce exposure of passwords and OTPs
  4. 04Secure API credentials and user input

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/dhruvanbhalara/skills --skill flutter-security

After installing, type/flutter-securityin Claude Code to confirm it loaded.

Details

From the project README

Security & Data Integrity (Architect Level)

  • AES-256-GCM: Use Authenticated Encryption for all sensitive storage.
  • Secret Storage: Mandatory use of flutter_secure_storage for encryption keys and master-derived keys.
  • Key Derivation: Mandate NIST-approved hashing (Argon2id) for master password derivation before local storage encryption and export.
  • Memory Safety: Strictly clear sensitive variables (passwords, keys) from memory when the operation finishes or the app enters the background.
  • Clipboard Safety: Mandate programmatic clearing of sensitive data (OTPs, Passwords) after a short duration (30-60s).
  • Biometric Gate: Mandatory local authentication for any view, export, or destructive action.
  • Audit Log: All security-sensitive actions should be logged via AppLogger (excluding raw secrets).

Input & API Security

  • Input Validation: Validate and sanitize all user-facing input fields before processing or storage.
  • HTTPS Only: All API communication MUST use HTTPS. Consider certificate pinning for sensitive applications.
  • Token Storage: STRICTLY prohibit storing tokens, API keys, or credentials in source code or public repositories. Use flutter_secure_storage or environment-based injection.

Comments

Markdown supported