Flutter Dev + AppSec Engineer Confessions: How I Built a Privacy-Obsessed KRA PIN Checker That Even My Paranoid Security Friends Approve Of 🛡️🇰🇪
Hey devs, DevSecOps ninjas, and fellow security weirdos! 👋
I’m a part-time Flutter dev by night and a full-time Application Security Engineer by day. That means I spend 9-5 hunting bugs in other people’s code… and then come home to make sure I don’t become the bug myself. 😅
Let me tell you about PinSight(checKRA) – the app I built from absolute scratch that lets Kenyans verify any taxpayer PIN by kenyan IDs instantly using M-Pesa tokens.
No login. No data stored. No “free tier” nonsense. Just pure, privacy-first magic.
And yes — ONE codebase, ALL platforms:
✅ Android
✅ iOS
✅ macOS
✅ Windows
✅ Linux
Because why write the same secure app five times?
Here’s the story from both sides of my brain:
1. The Developer Side (Flutter Joy 🎨)
- Entire UI in Flutter → single codebase, zero platform-specific nightmares
- Kenyan-themed design with slide + fade animations (
animated_widgets) - Single screen flow: dropdown → ID → “Check PIN” → result card in flag colors 🇰🇪
- Token balance in app bar, auto-triggers Buy Tokens dialog when zero (feels like magic)
-
flutter_dotenvso I never commit secrets (lesson learned the hard way)
2. The Security Engineer Side (Paranoia = Default Setting 🔒)
Most apps treat privacy like a suggestion. Mine treats it like oxygen.
What I deliberately DIDN’T do:
- ❌ No Firebase Auth
- ❌ No Google/Sign-in-with-anything
- ❌ No SharedPreferences / Keychain abuse
- ❌ No logging of IDs, names, or phone numbers
- ❌ No analytics with PII (Firebase Analytics events only, anonymized)
What I DID do (AppSec flex):
- Every query is ephemeral – deleted instantly after response
- Tokens stored on private Node.js backend (MongoDB Atlas) behind HTTPS
- Tokens auto-delete when count = 0 (no zombie data)
- M-Pesa callback IP-whitelisted to Safaricom only
- Always ACK
ResultCode: 0to M-Pesa (no infinite retries) - Signed releases with upload keystores (Android) & Apple Developer certs (iOS/macOS)
- Secrets in
.env– never committed - Custom regex validation per taxpayer type
3. The DevSecOps Side (Shift-Left or GTFO)
- Backend on Render with auto-TLS
-
/healthendpoint for uptime monitors - MongoDB Atlas IP access list
- Full CI/CD ready (GitHub Actions workflows in repo)
- Tested every flow in Daraja sandbox
- Repo structured so contributors can’t leak secrets
Payment Methods (Kenya + Global)
- 🇰🇪 M-Pesa STK Push & Buy Goods (instant)
- 🌍 PayPal coming next week! (for diaspora & international users)
Pricing? Brutally honest:
1 token = 1 verification. Buy exactly what you need.
KES 50 → 1 token
KES 100 → 2 tokens
KES 300 → 6 tokens
KES 600 → 14 tokens (best value)
Pay via M-Pesa → approve → paste SMS code → done.
PayPal flow drops soon — same token system, global reach.
Tech Stack
Frontend: Flutter (Dart) – truly cross-platform
Backend: Node.js + Express + MongoDB Atlas
Payments: Safaricom Daraja API + PayPal (incoming)
Hosting: Render (paid HTTPS)
Analytics: Firebase (events only)
Download Links
- Android: Play Store (live!)
- iOS: App Store (review passed, live in 24h)
- macOS / Windows / Linux: Direct download from GitHub Releases
- APK / IPA / DMG / EXE / AppImage on request – DM “AppSec approved” 😉
GitHub – All Assets for early access of the app
🔗 assets + desktop builds:
https://github.com/HovSaintBrandon/checKRA-supaApp-release
Star it if you hate data leaks. Fork it if you want to help add PayPal! 🚀
Support: hovsaintbrandon@gmail.com
If you’re a dev who actually cares about security, a DevSecOps warrior tired of fixing messes, or just a Kenyan (or friend of Kenya) sick of shady “free” PIN checkers that sell your data…
…try it. I built it the way I wish EVERY app was built.
Let’s make privacy the default — on every platform. 🇰🇪🔒🌍
P.S. Yes, I pentest my own app in my free time. Yes, I’m that guy. 😎
Top comments (0)