How to Prevent Users from Hacking Your FlutterFlow App

Firebase App Check is the most impactful anti-abuse measure available to FlutterFlow apps. It verifies that API requests come from your legitimate app binary using device attestation (Play Integrity on Android, App Attest on iOS). In the Firebase Console, go to App Check under the Build menu. Click Get started. For your Android app, select Play Integrity as the provider. For your iOS app, select App Attest. Register both apps. In your Flutter project (after exporting from FlutterFlow), add firebase_app_check: ^0.3.1 to pubspec.yaml. In main.dart, initialize App Check before calling Firebase.initializeApp: await FirebaseAppCheck.instance.activate(). Once enforced in the Firebase Console, all Firestore, Storage, and Cloud Function requests from unregistered or tampered clients are automatically rejected.

1// main.dart — initialize Firebase App Check
2import 'package:firebase_app_check/firebase_app_check.dart';
3
4void main() async {
5  WidgetsFlutterBinding.ensureInitialized();
6  await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform);
7  await FirebaseAppCheck.instance.activate(
8    androidProvider: AndroidProvider.playIntegrity,
9    appleProvider: AppleProvider.appAttest,
10    webProvider: ReCaptchaV3Provider('YOUR_RECAPTCHA_SITE_KEY'),
11  );
12  runApp(MyApp());
13}

After exporting your FlutterFlow project, open the android/app/build.gradle file. In the release buildType, set minifyEnabled to true and shrinkResources to true. Create or edit android/app/proguard-rules.pro to keep Firebase and Flutter classes while obfuscating your custom code. For Flutter's built-in obfuscation, build the release APK or App Bundle with the --obfuscate flag: flutter build apk --release --obfuscate --split-debug-info=build/debug-info. This renames all Dart classes, methods, and variable names in the compiled binary making decompiled code unreadable. For iOS, Xcode's default release build settings enable symbol stripping automatically — no additional configuration needed.

1# android/app/proguard-rules.pro
2# Keep Firebase classes
3-keep class com.google.firebase.** { *; }
4-keep class com.google.android.gms.** { *; }
5# Keep Flutter engine
6-keep class io.flutter.** { *; }
7-dontwarn io.flutter.**
8# Keep your app entry points
9-keep class com.yourcompany.yourapp.MainActivity { *; }
10# Remove logging in release
11-assumenosideeffects class android.util.Log {
12    public static *** d(...);
13    public static *** v(...);
14    public static *** i(...);
15}

Rooted Android and jailbroken iOS devices can bypass certificate pinning, intercept traffic, and run modified versions of your app. Create a Custom Action in FlutterFlow named checkDeviceIntegrity. Add the flutter_jailbreak_detection: ^1.9.0 package as a dependency. Call JailbreakDetection.jailbroken to check iOS and JailbreakDetection.developerMode for Android root detection. On page load of your app's main screen, run this check. If the device is compromised, you have three options: block the app entirely with a dialog, show a warning and reduce functionality, or silently log the device for monitoring without blocking the user. Choose based on your app's sensitivity — banking apps block, general apps typically only log.

1// Custom Action: checkDeviceIntegrity
2// pubspec: flutter_jailbreak_detection: ^1.9.0
3import 'package:flutter_jailbreak_detection/flutter_jailbreak_detection.dart';
4
5Future<bool> checkDeviceIntegrity() async {
6  try {
7    final isJailbroken = await FlutterJailbreakDetection.jailbroken;
8    final isDeveloperMode = await FlutterJailbreakDetection.developerMode;
9    return isJailbroken || isDeveloperMode;
10  } catch (_) {
11    // If detection fails, assume safe to avoid false positives
12    return false;
13  }
14}

Client-side rate limiting (disabling a button after tap) is easily bypassed. Real rate limiting happens in Cloud Functions. Use Firebase's built-in rate limiting by tracking request counts per user in Firestore. In each Cloud Function, read a Firestore ratelimits/{userId} document, check the requestCount and windowStart fields, and reject requests that exceed your threshold (e.g., 10 requests per minute). Increment the counter on each valid request. Reset the counter when the window expires. For higher-volume apps, use a Redis cache (via Upstash or Google Cloud Memorystore) instead of Firestore for rate limit counters — Firestore writes have ~100ms latency which adds up in high-traffic scenarios.

Never trust data sent from the FlutterFlow app to Cloud Functions. Users can intercept and modify the request payload before it reaches your server. In every Cloud Function, validate all input fields: check that strings do not exceed maximum lengths, numbers are within expected ranges, emails match a valid format, and required fields are present. Use a validation library like joi or zod in Node.js Cloud Functions. For Firestore writes triggered directly from FlutterFlow (without a Cloud Function), use Firestore Security Rules to validate field types and value constraints using the request.resource.data object. This prevents attackers from writing malformed or malicious data by intercepting the Firestore write call.