Flutter 3.47

Apply the Dart 3.13 baseline first. These rules cover Flutter 3.47 configuration, storage, networking, authentication, navigation, deep links, WebView, platform channels, permissions, plugins, logging, builds, and release.

Configuration and secrets

• Treat --dart-define, String.fromEnvironment, assets, resources, and compiled constants as extractable; none is a secret store.
• Keep environment endpoints and feature policy in signed release configuration and reject request-controlled endpoint switching.
• Separate development, test, staging, and production application identifiers, credentials, and deep-link domains.
• Obtain short-lived credentials after user or device authentication and invalidate them on logout and revocation.
• Minimize sensitive application state and clear it when accounts, tenants, or authentication sessions change.

Storage and cryptography

• Store credentials and keys through a reviewed Keychain/Android Keystore plugin; shared_preferences is not a secret store and must not hold secrets.
• Keep sensitive data out of caches, screenshots, clipboard, backups, external storage, and unencrypted local databases.
• Keep secrets and authoritative state out of RestorationBucket; its values are StandardMessageCodec-serialized and cached by the engine/platform for process restoration. Store only a bounded opaque identifier and reauthorize before refetching state.
• Use platform cryptography or reviewed packages with authenticated encryption and managed keys.
• Bind local encrypted records to the correct account and tenant and delete them under