Expectations

We treat security issues equivalent to a P0 priority level
and release a beta or hotfix for any major security issues
found in the most recent stable version of our SDK.

Any vulnerability reported for flutter websites like
docs.flutter.dev doesn’t require a release and will be
fixed in the website itself.

Flutter doesn’t have a bug bounty program.

Receiving security updates

The best way to receive security updates is to subscribe to the 
flutter-announce mailing list or watch updates to the
Discord channel. We also announce security updates in the
technical release blog post.

Best practices

Keep current with the latest Flutter SDK releases.
We regularly update Flutter, and these updates might fix security
defects discovered in previous versions. Check the Flutter
change log for security-related updates.