Best pentest companies for Flutter and React Native apps

Akande Simpa Lead Security Engineer & Cofounder, Simpa Labs Comprehensive Security Partner (CSP)

You built your fintech app in Flutter to save time. You built it in React Native so you only need one engineering team. That makes perfect business sense. It also introduces a massive security blind spot.

Most penetration testing companies in Nigeria run generic mobile security scanners. These scanners look for standard Android Kotlin vulnerabilities or iOS Swift flaws. They completely ignore the massive Dart payloads and minified JavaScript bundles that actually run your application logic. A generic tester will mark your app as secure while an attacker downloads your entire React Native source code in plaintext.

At Simpa Labs, we specialize in adversarial reverse engineering of cross-platform apps. We understand the specific architecture of Flutter and React Native. We know exactly how to break the frameworks your team relied on. If you want a real assessment of your cross-platform security posture, you need testers who understand the runtime engines.

Why Flutter and React Native need framework-specific testing

Flutter uses Dart. Dart compiles to native ARM code. React Native uses JavaScript. It runs JavaScript in a Hermes or V8 engine. Neither works the same as a native iOS Swift app. Neither works the same as a native Android Kotlin app.

The certificate pinning bypass techniques are entirely different. The static analysis tools you use on Java do not work on Dart snapshots. The secrets extraction process requires custom scripting. A mobile pentest team that only tests native apps will miss fifty percent of your framework-specific vulnerabilities.

We test Flutter and React Native applications daily for the biggest fintechs in Africa. The findings below represent the exact issues we exploit to compromise cross-platform financial products.

Flutter-specific vulnerabilities we test

1. Certificate pinning bypass via Dart runtime instrumentation

Certificate pinning stops attackers from intercepting the traffic between the mobile app and your backend API. It is a mandatory requirement for banking apps. In native Android apps, pinning is handled by the OkHttp library. Generic testers run a script to bypass OkHttp and move on.

Flutter does not use OkHttp. Flutter's networking stack uses Dart's dart:io HttpClient. It is completely isolated from the operating system's native HTTP stack. Standard SSL unpinning scripts do absolutely nothing to a Flutter app. We use custom Frida instrumentation to hook directly into the compiled Dart runtime functions.

// Frida script targeting Flutter/Dart SSL pinning
// (simplified for illustration)

// Flutter apps on Android use libflutter.so
// SSL verification happens in dart::bin::SSLFilter::Handshake
Java.perform(function() {
  // Hook the Dart SSL handshake to bypass certificate checks
  // The exact offsets vary by Flutter version and build type
  // This is why framework-specific tooling matters
  const libflutter = Process.getModuleByName("libflutter.so");

  // We identify the ssl_verify_peer_cert offset
  // through binary analysis of the specific Flutter version
  Interceptor.attach(libflutter.base.add(OFFSET), {
    onLeave: function(retval) {
      retval.replace(0); // Return ssl_verify_ok
    }
  });
});

By calculating the specific memory offsets of your compiled Dart version, we force the app to trust our malicious certificate. We then intercept every single API request, including authentication tokens, biometric confirmations, and payment payload data. We prove exactly what a man-in-the-middle attacker can steal.

2. Shared preferences and local storage extraction

Flutter apps heavily rely on the shared_preferences package. This package stores data in SharedPreferences on Android (as unencrypted XML files) and NSUserDefaults on iOS. These files are readable on a rooted Android device or jailbroken iOS device without any special permissions.

Developers use this package because it is easy. We routinely find JWT tokens, device fingerprints, unhashed PIN codes, and sometimes full KYC data stored in these XML files. We dump this data in seconds. If you build fintech products, you must use the flutter_secure_storage package to leverage the hardware Keystore. We verify that you actually did.

3. Flutter app reverse engineering via snapshot analysis

When you compile a Flutter app for production, it generates Dart native snapshots. Most developers think this compiled binary code is secure from reverse engineering. They are wrong.

We use advanced decompilation tools like Doldrums and custom IDA Pro plugins to parse these snapshots. We extract class names. We extract function signatures. We dump every string literal. This exposes your hidden API endpoints, your hardcoded AWS credentials, and your internal feature flags. We run this deep binary analysis on every single Flutter app engagement.

React Native-specific vulnerabilities we test

1. JavaScript bundle extraction and analysis

React Native apps do not compile your business logic to machine code. They bundle your entire JavaScript application into a single file (usually index.android.bundle or main.jsbundle) and ship it inside the APK or IPA.

Extracting this bundle gives us near-source-level access to your application. We do not have to guess how your app works. We just read the code. We pull the APK. We unzip it. We extract the bundle. We format it.

# Extract JavaScript bundle from React Native APK
unzip your-app.apk -d apk-contents
find apk-contents -name "*.bundle" -o -name "*.jsbundle"

# The bundle is minified but readable
# Search for secrets, API endpoints, and business logic
cat apk-contents/assets/index.android.bundle | \
  grep -E "(api_key|secret|password|token|localhost|staging|prod)" | \
  head -50

Inside that bundle, we find your staging environment passwords. We find the secret keys for your analytics platforms. We find the exact logic you use to validate transaction PINs locally before sending them to the server. If your app relies on hiding logic in the frontend, React Native makes that logic totally public. We map all of it.

2. AsyncStorage reading on rooted devices

React Native's AsyncStorage API is notorious for data leaks. It stores data in a plaintext SQLite database on Android. This database is completely readable on a rooted device.

Any data your app stores in AsyncStorage should be considered accessible to any attacker who gains physical control of the phone and roots it. We find active authentication tokens, sensitive session data, and user preferences stored here constantly. We verify that your engineering team migrated to encrypted storage solutions like react-native-keychain.

3. Deep link hijacking

React Native apps frequently use deep links for OAuth callbacks, payment redirects, and social sharing flows. If your deep link scheme is not properly validated, a malicious app installed on the same device can register the exact same scheme.

When the user completes a payment on a web view, the redirect fires. The malicious app intercepts the deep link. It captures the OAuth tokens or payment confirmation parameters before your React Native app even sees them.

<!-- Vulnerable: custom scheme without validation -->
<intent-filter>
  <action android:name="android.intent.action.VIEW" />
  <data android:scheme="yourapp" /> <!-- Any app can register this -->
</intent-filter>

<!-- More secure: use App Links (HTTPS) with verified domain -->
<intent-filter android:autoVerify="true">
  <action android:name="android.intent.action.VIEW" />
  <data android:scheme="https" android:host="yourapp.com" />
</intent-filter>

What we deliver for a Flutter or React Native pentest

We deliver separate test coverage for both the Android and iOS builds of your app. We execute deep API security testing on the backend infrastructure your app talks to.

You receive a heavily detailed technical report with findings mapped by severity and component. We schedule a walkthrough call with your mobile and backend engineering teams to ensure they understand the exact exploit paths. We perform a full retest after your team ships the fixes. The retest is always included in the initial cost.

For fintech apps, we prioritise findings that create immediate financial risk. We look for authentication bypass, payment flow manipulation, massive data exfiltration, and credential exposure. Everything else is documented and severity-ranked, but we do not delay communicating critical financial vulnerabilities.

Do not trust generic mobile testing companies with your cross-platform apps. Hire engineers who know how to decompile Dart and rip apart JavaScript bundles.

Related reading

Blog: Flutter penetration testing · React Native penetration testing · Flutter security audit checklist

Blog: Certificate pinning in mobile banking · Hardcoded API keys in mobile apps · SSL pinning bypass

Services: Mobile app penetration testing · Penetration testing