Flutter Security Hardening Skill for Claude Code

Audit, score, and harden any Flutter app against reverse engineering, data theft, and vulnerabilities. Scans source code and built APKs, generates a 0-100 security score, and can auto-fix issues with your permission.

v1.1.0 | Companion: Reverse Engineering Skill

Quick Start

# Step 1: Add the marketplace (one-time)
claude plugin marketplace add abhiabby3008/flutter-security-hardening-skill

# Step 2: Install the plugin
claude plugin install flutter-security-hardening

# Update to latest version
claude plugin update flutter-security-hardening

The skill auto-checks for updates every time it runs.

What Is This?

Every Flutter app can be reverse engineered. Someone can run strings on your libapp.so and find your API keys. They can pull your SharedPreferences via adb and steal auth tokens. They can bypass SSL pinning and intercept your API calls.

This skill scans your Flutter project (or your built APK) for every one of these vulnerabilities, scores them, and either fixes them automatically or shows you exactly how to fix them with production-ready code examples.

It's the defense counterpart to the flutter-reverse-engineering skill — that skill shows how to break in, this one closes every hole it finds.

Two Input Modes

Mode A: Source Code (Scan & Fix)

Open your Flutter project directory and say:

> secure my Flutter app
> run a security audit
> protect my API keys from reverse engineering

The skill scans pubspec.yaml, all .dart files, AndroidManifest.xml, Info.plist, Firebase config, and build scripts. Produces a security score and offers to fix every issue found.

Mode B: Built APK (Post-Build Verification)

Point it at your release APK to verify your security measures actually survived compilation:

> check if my APK is secure: build/app/outputs/flutter-apk/app-release.apk
> scan this APK for leaked secrets
> audit ~/Downloads/myapp.apk

This is the "attacker's eye view" — it runs the same string extraction an attacker would, checks if obfuscation actually worked, verifies the manifest flags are correct in the compiled binary, and confirms no secrets leaked into the final build.

Mode C: Both (Source + APK Comparison)

When you have both source code and the built APK, the skill compares what you intended vs what the binary actually contains:

> audit my project and verify the build too

Check	Source Intent	Binary Reality	Match?
Obfuscation	`--obfuscate` in build script	Class names readable in binary	NO
API Keys	3 keys in source	2 visible in `libapp.so`	NO — 1 leaked
allowBackup	Set to false in code	false in manifest	YES

12 Security Phases

Core Audit

Phase	What It Does
0. Security Audit	Full project scan. Checks pubspec for security packages, scans all `.dart` files for hardcoded secrets, checks manifest flags, Firebase rules, storage usage. Generates 0-100 security score with per-category breakdown.
1. Secret Protection	The #1 problem. Finds every hardcoded key/token/password. Ranks 4 fix options: server-side proxy (best), native NDK storage (good), encrypted config (moderate), environment separation (minimum). Provides migration steps for each secret found.
2. Code Obfuscation	Checks if `--obfuscate --split-debug-info` is configured. Sets up ProGuard/R8 for Android native code. Verifies tree shaking. In APK mode: proves whether obfuscation actually worked by extracting class names from `libapp.so`.
3. Network Security	SSL/TLS certificate pinning with Dio (code provided). Creates `network_security_config.xml`. Checks iOS App Transport Security. Sets up HMAC request signing. Handles certificate rotation strategy.
4. Local Data Protection	Migrates sensitive data from SharedPreferences to `flutter_secure_storage`. Encrypts Hive databases. Sets up SQLCipher. Clipboard protection with auto-clear. Secure logout (clear all sensitive data).
5. Tamper Detection	Root/jailbreak detection, APK signature verification, emulator detection, anti-debugging, Frida/Xposed hook detection. Integrates freeRASP (by Talsec) for comprehensive runtime protection.

flutter-security-hardening

Popularity

What's Inside

README