This page summarizes FlutterGo.AI security practices for customers and marketplace reviewers. It complements our Privacy Policy.
1. Principles
- Least privilege — tokens and connectors only receive the scopes needed for the action you request.
- Account scoping — MCP and API access is bound to the signed-in FlutterGo user; projects are not shared across accounts by default.
- No checkout inside AI chats — plan information links to fluttergo.ai/pricing; payment stays on FlutterGo.
- Destructive actions require confirmation (for example project delete and store deploy start).
2. Accounts & authentication
Users authenticate with FlutterGo account credentials (and email verification where required). Remote MCP clients use OAuth with PKCE; access tokens are short-lived and refresh through the OAuth token endpoint. Do not paste FlutterGo passwords into third-party chat tools.
3. Project isolation
Each project belongs to an account (or explicit collaborators). Remote MCP tools resolve projects for the authenticated user only. Responses omit internal owner identifiers and filesystem paths that are not needed by the client.
4. Secrets & store deployment
Apple certificates, App Store Connect keys, and Play service-account JSON are entered in the FlutterGo Deploy wizard and stored as encrypted GitHub secrets for Actions — they must not be sent as ChatGPT/Claude tool arguments. FlutterGo does not write those secrets into application logs.
5. MCP & OAuth
The production MCP endpoint is https://fluttergo.ai/api/mcp/remote. Clients complete OAuth against FlutterGo; tools such as apply_code, flutter_preview, and build_android run as that user. Connector OAuth for GitHub, Figma, Firebase, and Supabase is started from MCP or the FlutterGo UI and completed in the browser. See MCP integration.
6. Transport & logging
Production traffic uses HTTPS. We retain operational logs needed to run and secure the Service and to investigate abuse. Content you put in projects is treated as customer data under the Privacy Policy.
7. Report a vulnerability
Email security@fluttergo.ai (or support@fluttergo.ai with subject “Security”) with a clear description and steps to reproduce. Please avoid public disclosure until we have confirmed a fix or mitigation.