What are key security best practices for a production MAUI app?

Store secrets in SecureStorage, never in code or Preferences; use HTTPS everywhere (optionally pinning); enable trimming/obfuscation to raise the bar on reverse engineering; validate all input; keep tokens short-lived with refresh; request minimal permissions; and encrypt sensitive local data (SQLCipher). Assume the client is untrusted—enforce authorization on the server.

// Enforce transport security and minimal token lifetime server-side;
// client stores only short-lived tokens in SecureStorage.