Flutter Security
Hardening Guide

# ✗ NEVER: hardcode in source
# const apiKey = 'AIzaSyABC123...';

# ✓ Inject at build time via --dart-define
$ flutter build apk \
  --dart-define=API_KEY=your_api_key_here \
  --dart-define=FIREBASE_PROJECT_ID=my-project \
  --dart-define=BASE_URL=https://api.your-app.com \
  --release

# Or from a file (Flutter 3.7+)
$ flutter build apk \
  --dart-define-from-file=.env.production \
  --release

# .env.production format (JSON):
# { "API_KEY": "xxx", "BASE_URL": "https://api.your-app.com" }

// Access dart-define values — only available after build injection
abstract class Env {
  // fromEnvironment reads the --dart-define value
  static const String apiKey = String.fromEnvironment(
    'API_KEY',
    defaultValue: '',
  );

  static const String baseUrl = String.fromEnvironment(
    'BASE_URL',
    defaultValue: 'https://api.your-app.com',
  );

  static const bool isProduction = bool.fromEnvironment(
    'IS_PROD',
    defaultValue: false,
  );

  // Validate all required vars are set at app start
  static void validate() {
    assert(apiKey.isNotEmpty, 'API_KEY not set. Use --dart-define=API_KEY=...');
    assert(baseUrl.isNotEmpty, 'BASE_URL not set.');
  }
}

void main() {
  // Validate secrets are injected before app launches
  Env.validate();
  runApp(const MyApp());
}