This document details the security posture, environment variable protection, Firebase security guidelines, and vulnerability disclosure process for the Khetse project.

Khetse is a Flutter application backed by Firebase (Authentication, Firestore, Cloud Storage, Crashlytics) and RevenueCat (In-App Purchases). Because agricultural transactions, user location data, and payments involve sensitive user information, security is a core priority.

1. Least Privilege Firestore Rules: Client code accesses Firestore collections (users, crops, orders, mandi_rates) enforced strictly through security rules. User profile and transaction data are restricted to authenticated users owning the respective documents.
2. Credential Protection: Hardcoded secret keys, Firebase service account keys, and private API credentials are strictly prohibited in source code.
3. Secure Environment Setup: Dynamic parameters and API keys are provided via environment configuration (.env) using flutter_dotenv or compile-time parameters (--dart-define).

• Never commit .env files or google-services.json / GoogleService-Info.plist containing production credentials.
• Always add .env to .gitignore.
• Provide safe placeholder templates in .env.example.

• Khetse utilizes geolocator and geocoding for nearby mandi discovery and direct farmer-to-consumer delivery estimation.
• Location permissions must be requested explicitly with user context.
• Precise GPS coordinates are stored only when necessary for order fulfillment and never sold or shared with third parties.

• In-app purchases and subscription plans are processed through RevenueCat (purchases_flutter).
• Server-side webhook validation is used to verify purchase receipts rather than relying solely on client-side status state.

If you discover a security vulnerability within Khetse, please report it responsibly:

1. Email security reports directly to: security@khetse.app (or contact maintainer via GitHub profile).
2. Include the following details:
   • Type of issue (e.g., Firestore rule bypass, hardcoded key, location data exposure).
   • Step-by-step instructions to reproduce the vulnerability.
   • Potential impact of the issue.
3. The maintainers will acknowledge your report within 48 hours and provide periodic status updates until resolution.

• Dependencies are monitored via Dependabot (.github/dependabot.yml).
• Run static security analysis on Flutter packages using:

  flutter pub outdated