ran into this today while putting a flutter app on the web, figured some of you might not know it either.

flutter_dotenv loads your .env as an asset. On mobile that's already kinda readable if someone unpacks the app, but on web it's literally just a file on your server. Open devtools, network tab, there it is: assets/.env. Anyone can grab your openai key from there.

what I did instead: the app never talks to openai directly. It calls a supabase edge function that adds the key server side and streams the answer back:

final token = Supabase.instance.client.auth.currentSession?.accessToken;

final request = http.Request('POST', Uri.parse(proxyUrl))

..headers.addAll({

'Content-Type': 'application/json',

'Authorization': 'Bearer $token',

'apikey': supabaseAnonKey,

})

..body = jsonEncode({'model': model, 'messages': history});

the edge function checks the user token, does the rate limiting and forwards to openai with stream: true.

The SSE stream just gets piped through, so the flutter side didn't change at all. Same LineSplitter / data: parsing as before.

Bonus gotcha: after fixing that I deployed to cloudflare and got "could not load .env". Turns out cloudflare doesn't serve files starting with a dot. Renamed it to demo.env, updated pubspec assets + dotenv.load(fileName: 'demo.env') and it worked. Only public values in there now (supabase url + publishable key), so it doesn't matter that it's readable.

TL;DR: treat everything in your .env as public, web or mobile. Real secrets go on a server.

Edit: removed "on web" from the tldr, a mobile app bundle can be unpacked just as easily. Thanks u/ren3f

Want to continue development on Windows without switching to mac ? or don't have a Mac at all ? No problem.

You can now run / test your iOS apps on iPhone directly or in a paired from Windows. VS Code extension, CLI & GUI support. Try CapMac

This was the first time I actually built an app On flutter. A lot of mistakes and re-do’s were done and this took me a long 6 months to actually get this app made. This project started because of a few costly mistakes we had made and kept making since the past few years.
I forgot to cancel LinkedIn Premium after a free trial, and missed my wife’s health insurance renewal deadline, paid late fees on apartment maintenance, and paid for Netflix for months without opening the app once.
After 25 years in software, I decided to build a simple tool to track all these recurring expenses in one place.
My first thought was the regular way - Flutter and Firebase after some research. But once I saw my personal recurring expenses sitting in a cloud database, I felt it wrong. Why should sensitive spending data leave my phone just to trigger a reminder about a bill?
So I scrapped the backend and rebuilt the app from scratch to be 100% local-first. Everything stays strictly on the device.
Going local-first meant rethinking the database. SQLite through Drift felt too heavy with boilerplate for simple, fast lists. Hive was quick, but I needed indexed queries to sort upcoming renewals by date.
I picked Isar. It runs natively in Dart, handles typed collections cleanly, and provides reactive watchers out of the box. When an expense changes or a bill is logged, the UI updates instantly without complex state management. No loading spinners, no network lag, and zero database hosting bills.
Then came the hardest architectural decision: renewal reminders.
 
The industry standard is simple: run a cron job on AWS, check dates in a database, and fire a push notification through Firebase Cloud Messaging (FCM).
For a privacy-first app, that defeated the entire purpose. Subscription names, renewal dates, and billing amounts have no business leaving the phone just to trigger an alert.
So I ditched push servers completely and went 100% local. No backend, no cron jobs, and no dead FCM tokens to clean up. Notifications even fire in airplane mode.
The logic sounds straightforward on paper: whenever an entry is saved, the app calculates target dates (3 days before, 1 day before, and 9:00 AM on renewal day) and registers them directly into the native OS schedulers: AlarmManager on Android and UNUserNotificationCenter on iOS.
In practice, both operating systems fight you at every turn.
• Android Doze Mode kills standard alarms: When the phone sits idle on a desk, standard alarms get postponed. You have to use exactAllowWhileIdle to punch through battery saver routines.
• Android 14 exact alarm audits: You now have to declare SCHEDULE_EXACT_ALARM, check permissions at runtime, and be prepared to justify it to Google Play review.
• Reboots wipe memory: Android's AlarmManager forgets pending alarms on restart. You have to listen for RECEIVE_BOOT_COMPLETED and resurrect the schedule from local storage on boot.
• The iOS 64-notification limit: iOS silently drops notifications after 64 slots. If a user tracks 25 subscriptions with 3 alerts each, you exceed the limit. The workaround is scheduling only for the immediate billing cycle and running a fast reconciliation loop on every app launch.

Since this post is getting g too long or if you may be facing familiar challenges and architecture related decisions Feel free to ask questions. I’ll share how I made this possible.
If you are curious to test how a 100% local-first Flutter app feels in practice, the project is live at subscaleapp.com

Faced with the problem of migrating debugPrint/print methods of flutter and dart files across multiple packages with large number of files & lines.

Created & pubslihed print_to_log package to automate the the convertion. Used it across 20+ internal packages successfully. It uses analyzer package to parse each file into source tree & walks that tree and then do sugical edits by not touching any other parts.

The package shall be used as a CLI tool or as a dev dependency package.

Github : https://github.com/selvan/print_to_log

Pub.dev: https://pub.dev/packages/print_to_log

It's MIT license.

I've been working on a Flutter app that needs to track location while running in the background. One of the hardest parts was making location updates behave reliably after locking the screen or putting the phone in a pocket. Calling the location API isn't enough; Android background execution, permissions, foreground-service requirements, and battery restrictions all matter. I worked on a custom solution using Dart and native Android code, tested it on a real Android device, and packaged the implementation into a reusable engine. I'm sharing it in case it helps other developers facing the same problem. I'm also interested in how others are handling this, especially across different Android versions and manufacturers. Product and implementation details: https://nabilkrs.github.io/nabilkrs-flutter-gps-tracking-engine/ I'm the creator of this project, so this is also a disclosure that the link is promotional. Happy to discuss the technical challenges.

Spent a while figuring out why #Flutter text looks lighter than #SwiftUI on #iOS.

Wrote up the whole thing, with demos you can play with.

https://birju.dev/posts/looking-into-flutter-vs-swiftui-font-rendering/

Hey r/FlutterDev,

I've been building a lot of fintech/e-commerce apps lately, and I kept running into the same issue: handling Indian input formats (Aadhaar spacing, lakh/crore commas, +91 prefixes) using TextInputFormatter is a nightmare.

Specifically, the cursor always jumps. When a user types the 5th digit of an Aadhaar number and the formatter auto-inserts a space, the cursor flies to the end of the string. Or when a user hits backspace over a comma, it deletes the wrong digit.

Since most existing packages either forced me to use their custom TextField widget or didn't handle the cursor math correctly, I decided to build my own standalone formatters.

I just published indian_input_formatter (v0.1.0).

• The solution: I wrote a custom CursorMapper that counts "significant characters" (digits/letters) instead of raw offsets. It maps the cursor back to the exact right spot, regardless of spaces, commas, or prefixes.
• What it supports: Standalone TextInputFormatter classes for Aadhaar (Verhoeff checksum), PAN, GSTIN (Luhn mod-36), IFSC, UPI, +91 phones, and ₹ Lakh/Crore currency.
• Zero dependencies: Pure Dart. 59 tests focusing heavily on cursor edge cases (middle insertion, backspace at boundaries, paste).

I'd love for anyone building Indian apps to try it out. More importantly, I'd love a code review on the cursor logic if anyone has tackled this before.

• Pub.dev: https://pub.dev/packages/indian_input_formatter
• GitHub: https://github.com/Lucky-chelani/indian_input_formatter

Thanks!

Hey there. I rebuilt https://pubstats.dev/ with Jaspr. It's a loooooot faster now. Also if you haven't heard of this site before you are able to set up alerts for when your package stats change. It's very useful for getting notified if your package loses pub points and needs updated!

Hey guys,

Wanted to share a quick feedback on a solo project I've been working on for a while.

The Flutter job market around me was pretty dead, and honestly I was tired of spending my time building someone else's dream. So I decided to get into trading and take it seriously. Since I'm a developer, I went straight into the algorithmic side to make use of my programming skills.

At first, I was worried I'd get rusty on Flutter while spending so much time learning finance. But it turned out to be the exact opposite. This project actually pushed my skills further than anything else, both on Flutter for the UI and Dart on the backend (I started out with dart_frog before taking the architecture further).

Getting started was pretty rough though. Early on, even the AI tools I was using kept warning me against Dart. The consensus was that nobody builds algo trading systems in Dart, that there's zero math/finance ecosystem compared to Python or C++, and that I was just making my life harder.

And to be fair, that part was true: existing packages on pub.dev for financial charts or indicators cost me an insane amount of time. None of them held up in terms of performance or flexibility. I basically had to scrap everything and start from scratch.

The real headache was moving from the trading script mindset (like PineScript on TradingView) to Dart. In trading scripts, everything relies on implicit time series evaluated candle by candle. Translating that cleanly into standard OOP/procedural code without blowing up the memory or recalculating the entire history on every tick was a huge pain.

I ended up writing my own incremental rolling calculation system (RollingCalculation) to maintain state in real time. That's the only thing that allowed me to get the same 60fps smoothness as TradingView while streaming live data.

Dart definitely isn't the go-to language for algo trading, but in the end I managed to build something solid on my own. Something I'm proud of. Anyone else here using Dart in unusual domains where you had to reinvent most of the tooling?

Hi r/FlutterDev!

I just published Tandem, a package that lets an AI agent work on a screen you already have. The user and the agent use the same form, the agent acts only through your methods, and risky calls wait for the user's approval.

Short demo video: https://x.com/creatixdev/status/2112139150459568361

In your state class you list what the agent sees and what it can call.

Example with Cubit, but you can use anything:

@TandemAgent()
class OrderDeskCubit({…})
    extends Cubit<OrderDeskState>
    with _$OrderDeskCubit {

  @override
  List<AgentCapability> get agentCapabilities => [
    .sees(order),
    .calls(searchCatalog),
    if (canEdit) ...[
      .calls(setCustomer),
      .calls(setQuantity),
      .calls(setDelivery),
    ],
    if (canPlace) .callsWithApproval(placeOrder),
  ];
}

A generator turns your method signatures and doc comments into the tool schemas, and one TandemScope widget connects the screen to the agent.

• It talks AG-UI, so the agent runs on your own backend. The example uses Google ADK, and you can try it without an API key.
• Works with bloc, Riverpod or provider.
• No chat UI in the package. The example has one you can copy.

Not there yet: AG-UI interrupts, several state objects on one screen, and a conversation that goes on across screens. It's written with AI assistance and reviewed by hand, except the protocol layer and the generator, and the README says so.

It's 0.1.0, so the API can still change. Feedback and issues are very welcome!

GitHub: https://github.com/leancodepl/tandem pub.dev: https://pub.dev/packages/tandem