@twerske @ArkangelB I got to hang out with bothth of these folks the past week at @FlutterConfLAT. Flutter conference season is so gooood! 💙

building your next website? try dart & jaspr ✨

@ArkangelB exploring SSR and how it compares to flutter web

🔗 youtube.com/watch?v=gPNcR7…

@FlutterDev @ArkangelB I have already built our startup website with dart and jaspr!
Check it out here: casebeheard.com

Build your next website with Dart and Jaspr 🌐

Craig catches up with @ArkangelB, Senior Staff Engineer at Aplazo to discuss how Jaspr compares to Flutter Web and how easily AI coding agents integrate into your web workflow.

Won this Dash at FlutterConf Latam Cancun 2026 😎

Thanks @drcoderz

@FlutterDev #flutter #flutterconflatam

Welcome @somnio_software
Silver Sponsor de la 4ta ed. de FlutterConf LATAM a nuestro sponsor desde la edición #1
Silver Sponsor of FlutterConf LATAM's 4th edition, sponsoring since edition #1 💙
🎟️ flutterconflatam.dev 📅 22–23 sep | 📍Cancún, MX
#flutterconflatam #flutter

Frictionless Add-to-App: Type-safe Bidirectional Communication with Pigeon by Josué Lemus Miranda

🎟️ flutterconflatam.dev
📅 22 y 23 de septiembre | 🗓️ September 22–23
📍Cancún, Quintana Roo, Mexico
#flutterconflatam #flutter #fcl2026 #google #flutterdevs

The office today! 🤓

On our way to @FlutterconWorld, see you tomorrow, folks!!

We will talk about Jaspr and SDD; stay tuned!!

Are you interested in becoming a sponsor at the big event, Flutter Conference in LATAM?

¿Quieres ser patrocinador de la mayor conferencia de Flutter en LATAM?

Contact us!

Te esperamos | Join us at FCL2026
🎟️ flutterconflatam.dev
📅 22 y 23 de septiembre | 🗓️ September 22–23 📍Cancún, Quintana Roo, Mexico
#flutterconflatam #flutter #fcl2026 #google #flutterdevs

Te esperamos | Join us at FCL2026
🎟️ flutterconflatam.dev
📅 22 y 23 de septiembre | 🗓️ September 22–23 📍Cancún, Quintana Roo, Mexico
#flutterconflatam #flutter #fcl2026 #google #flutterdevs

Eric Windmill es Dev Advocate para Flutter y Firebase en Google. Eric Windmill is a Dev Advocate for Flutter and Firebase @Google.
🎟️ flutterconflatam.dev
📅 22 y 23 de septiembre | 🗓️ September 22–23
📍Cancún, Quintana Roo, Mexico
#flutterconflatam #flutter #fcl2026

Craig no solo conoce Flutter lo ha evangelizado desde adentro. Craig doesn't just know Flutter he's been evangelizing it from the inside.
🎟️ flutterconflatam.dev
📅 22 y 23 de septiembre | 🗓️ September 22–23 📍Cancún, Quintana Roo, Mexico
#flutterconflatam #flutter #fcl2026

Flutter Web, Jaspr, Gemini, Antigravity y @ArkangelB los esperan en #FlutterConfLatam

September 22–23 Cancun, México flutterconflatam.dev

I like consoly.app, it’s a fun way to learn a new programming language. It’s a great example of what you can build in Flutter. Built by @diegoveloper !

The GCP project of my @FlutterDev @Firebase app got suspended this weekend for abuse, after a single day of €3,167 in unauthorized Gemini API charges. The root cause turned out to be a #Firebase Hosting default that is hard to know about. Worth sharing what I learned.

I thought Cloud project was clean and safe. Client uses Firebase AI Logic (proxy, no on-device Gemini key) with App Check via Play Integrity / App Attest.

The suspension email said "key published on public sources." But: my GitHub repo is private and was never public. flutter build web was never run for this project. Where was the leak surface?

Google AI Studio showed three Gemini-callable keys. Two tight (server-side). One was a "Browser key (auto created by Firebase)" — Unrestricted, since Nov 2024. That was the web app in my generated firebase_options.dart, from when I configured Flutter web at project init.

Here's the part I didn't know about: Firebase Hosting auto-serves your web SDK config at a reserved URL — https://<project>.web.app/__/firebase/init.json — as plain JSON, unauthenticated, to anyone. It includes apiKey, appId, projectId, authDomain.

This endpoint is active whenever you have (a) a registered web app in Firebase Console + (b) any Hosting deploy. Contents of the deployed site are irrelevant. Mine was a simple CSS landing page that doesn't reference Firebase JS SDK at all. Endpoint leaked the key anyway.

Bots scrape *.web.app/__/firebase/init.json because the pattern is universal across every Firebase project. Mine got picked up, the key was Unrestricted (= usable for any enabled API), and someone burned €3K of Gemini inference in a few hours.

Project reinstated after appeal; outstanding balance still in review.

Lessons I missed:
- Auto-generated browser keys are Unrestricted by default (at least the time project was created). Always add HTTP referrer + API restrictions at creation.

- Don't register a web app unless you use the JS SDK.

- Set a Gemini spend cap + budget alert. €100/day cap. You can easily do this in Google AI Studio

What I would ask the Firebase team:

— Browser keys should default to restricted (HTTP referrer to project domains, API restriction to Firebase services) -> not sure this has changed after the date I created the project.

— Reserved __/firebase/init.json should be opt-in. Static websites hosted with Firebase Web hosting do not need the API key info.

— Firebase Console should warn when a key has been Unrestricted for >N days. Google AI Studio warns when you visit API keys page, but it should be visible on homepage.

— Default-on spend caps for Generative Language API.

TLDR; "Private repo" is not a meaningful security boundary when the key has another publicly-reachable surface. Audit not just your code, but every endpoint your project ID exposes including the ones the platform creates for you without telling you. Always manually verify API restrictions.

I am speechless. Thanks to the @FlutterDev and @Firebase teams for supporting me and patiently listening to my inputs. We did this together 🚀

|￣￣￣￣￣￣￣￣￣￣￣￣￣￣￣￣￣|
| Don't Push To Production On Friday |
|＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿|
. 😎
|\👐
/ \
━━━━━┓ ＼＼
┓┓┓┓┓┃
┓┓┓┓┓┃ ヽ😩ノ
┓┓┓┓┓┃ 　 /　
┓┓┓┓┓┃ ノ)　
┓┓┓┓┓┃
^^^^^^^^^^^Production^^^^

Cloud Functions and Admin SDK for Firebase now supports Dart as an experimental feature 🎯

This means Flutter developers can use the same programming language throughout their whole stack and share logic between the frontend and backend.