Security fixes are released as patch 1.0.x. Pin to ^1.0.11 and run flutter pub upgrade regularly; check CHANGELOG.md for Security entries.

• Private key / Signer: privateKey is now optional. If provided, must be 64 hex chars; invalid rejects with -32602 and renders initError – never crashes or logs. Read-only mode (Web3WalletConfig without privateKey/signer) needs no key; signing throws 4100. Prefer Web3Signer (WalletConnect / Secure Enclave) over embedding keys. Store keys via flutter_secure_storage + biometrics; do not hardcode.
• JS injection: provider info, chainId, accounts, errors are jsonEncoded before evaluateJavascript (lib/provider/provider_script.dart, lib/web3_js_bridge_callback.dart, lib/ethereum/ethereum_provider.dart:841).
• Permissions: Web3WebView.onPermissionRequest defaults to DENY; grant only after user prompt.
• RPC: use HTTPS with API key, pin certs via onReceivedServerTrustAuthRequest if needed.

• Email: via GitHub Security Advisories on https://github.com/datit309309/web3_webview – “Report a vulnerability” (private).
• Include: affected version, reproduction (DApp URL + Web3WalletConfig), WalletException.code if any, and whether privateKey was at risk.
• Response SLA: acknowledgement within 48h, triage within 5 business days, patch or mitigation guidance within 14 days.
• Disclosure: coordinated 90-day window after fix is published on pub.dev; reporters credited in CHANGELOG.md unless opted out.

• Prefer Web3Signer over privateKey; if using privateKey, load from secure storage, not Dart strings/assets
• Use read-only mode when only eth_call/eth_get* is needed
• Allowlist initialUrlRequest origins and gate showConnectWallet with controller.getUrl().host check
• Override onPermissionRequest to deny by default
• Handle WalletException codes 4001/4100/4200/-32602 in UI and onError (4100 = read-only without signer)
• Keep flutter_inappwebview and web3dart up to date