One page in, one page out. Print it, circle where each decision lands on the meter, and staple it to your first ADR before Lab 2.

Architecture Decision Record · Security

The Walking Skeleton Has No Skin

MAL Lab 01 · Flutter
& Foundations
Atlas, Mumbai
11 Jul 2026
ADR №
Date
Architect
Status
Draft Accepted Superseded
§1

Context

What are you building, and which secrets or sensitive data must exist on the device? (e.g. offline-first marketplace; payment tokens and a local catalogue live on-device.)

§2

The Five Skeleton-Stage Decisions

For each: mark where your choice lands on the reversal meter — cheap to change later, or effectively permanent. Spend your attention on the right end.

01

Where do your secrets live?

Wrong default

Hardcoded in a Dart constant, a bundled .env, or a config file shipped in the binary.

Secure default

On-device secrets in Keychain / Keystore (via secure storage). Powerful secrets stay server-side.

Cost to reverse after launch
CheapPermanent
Suggested: Permanent — a shipped secret must be rotated and treated as already leaked.
Our call & why
02

Where is the client / server trust boundary?

Wrong default

Pricing, discounts, eligibility and feature gates decided on the client "because it's faster."

Secure default

Treat the client as hostile. Anything that must be true — price, permission, payment — is enforced server-side.

Cost to reverse after launch
CheapPermanent
Suggested: High — moving logic server-side later means an API redesign.
Our call & why
03

Is data-at-rest encrypted — and where's the key?

Wrong default

Plaintext local database. Or encrypted, but with the key as a string literal three lines above.

Secure default

Encrypted store (e.g. SQLCipher). Key lives in Keychain / Keystore — never in the source.

Cost to reverse after launch
CheapPermanent
Suggested: High — retrofitting encryption means migrating live user data. Decide while the DB is empty.
Our call & why
04

What is your certificate-pinning stance?

Wrong default

"It's HTTPS, we're fine." A user with a proxy and their own cert can map your whole private API.

Secure default

Pin the cert/key you trust — and own a rotation plan so you can't brick clients in the field.

Cost to reverse after launch
CheapPermanent
Suggested: Cheap — the one you're allowed to defer, if you write down that you did.
Our call & why
05

What telemetry leaves the device?

Wrong default

Capture everything, sort out privacy later. PII rides out in request bodies, traces and screenshots.

Secure default

Allow-list what may leave. Mask screenshots, hash identifiers. Decide before you capture.

Cost to reverse after launch
CheapPermanent
Suggested: Medium — by the time you spot PII in logs, it's in backups and your vendor too.
Our call & why
§3

Decision

The stance you're taking, in one or two lines.

§4

Consequences we accept

The trade-offs and deferrals you're consciously taking on.

!

Never defer

There is exactly one decision on this page you never postpone: no long-lived secret ships inside the binary. Everything else can wait a lab — this cannot. Anything in the compiled app is readable, obfuscated or not.