The illusion of compiled security
Many developers believe that because Flutter compiles Dart to native ARM libraries (`libapp.so`), it is immune to the easy reverse-engineering that plagues JavaScript-based frameworks like React Native. This is a dangerous misconception.
Modern reverse-engineering frameworks, such as reFlutter and Doldrums, can dump the Dart object pools, reconstruct class structures, and extract hardcoded strings with terrifying efficiency. If your security relies on the obscurity of the compiled binary, an attacker will bypass it within hours.
The Flutter Security Audit Checklist
During our mobile penetration tests, we map our findings to the OWASP Mobile Application Security Verification Standard (MASVS). Below are the critical Flutter-specific implementations you must audit.
1. Secure Storage Implementation
The Flaw: Using the standard `shared_preferences` package to store authentication tokens, user BVNs, or cached balances. This package writes plaintext XML files to the device storage. A rooted device or a backup extraction will expose this data immediately.
The Fix: Replace it with `flutter_secure_storage`. This package encrypts data using `EncryptedSharedPreferences` on Android (backed by the Keystore) and Keychain on iOS.
2. Platform Channel Injection
The Flaw: Flutter uses `MethodChannel` to communicate with native Java/Kotlin/Swift code (e.g., to access the camera or Bluetooth). If you pass unsanitized input from Dart into a native platform channel that executes a system command or SQL query, you open the app to injection attacks.
The Fix: Strictly type-cast and validate all data crossing the platform bridge. Treat the native code as an API endpoint that requires input sanitization.
3. SSL Pinning Bypasses
The Flaw: Dart does not use the underlying OS's proxy settings or certificate store by default, meaning traditional tools like Burp Suite don't work out-of-the-box. However, attackers use tools like reFlutter or Frida to patch the Dart binary and bypass standard HTTP client pinning.
The Fix: Implement robust SSL Pinning using packages like `http_certificate_pinning`, but do not stop there. Obfuscate the pinning logic so it is harder for dynamic instrumentation tools (like Frida) to find and hook the verification function.
Code Obfuscation and Hardening
When deploying a Flutter fintech app to the Google Play Store or Apple App Store, you must compile it with the `--obfuscate` flag.
flutter build apk --obfuscate --split-debug-info=./debug-infoThis strips out the plaintext Dart symbol names, making it significantly more time-consuming for an attacker to understand your business logic during reverse engineering. Never ship a debug or profile build to production, as these contain the full Dart VM and source maps.
Handling Secrets in Dart
Never hardcode third-party API keys (like Google Maps, Sentry, or KYC vendor keys) directly into your Dart code. Attackers will extract them using the `strings` command against the `libapp.so` file. Instead, fetch sensitive keys dynamically from your backend API after the user has securely authenticated, and store them temporarily in memory.
Root & Jailbreak Detection
A financial application must not execute in a compromised environment. If the OS is rooted (Android) or jailbroken (iOS), the local sandbox is broken, allowing attackers to dump the memory of your app and extract encryption keys.
Implement packages like `freerasp` or `root_checker`. However, remember that client-side root detection is a cat-and-mouse game and can eventually be bypassed. Do not rely on it as your only defense; your backend APIs must still enforce strict validation.
Are you preparing to launch a new Flutter application or major update?
Book a Mobile App PentestHow Simpa Labs tests Flutter applications
When we conduct a penetration test on a Flutter application, we do not just run automated scanners. Our engineers perform deep, manual analysis:
- Binary Patching: We use reFlutter to rebuild the APK with a patched `libapp.so` to force the app to route traffic through our interception proxies, allowing us to inspect your API payloads.
- Memory Dumping: We use Frida to hook into the running process and dump the memory, searching for plaintext passwords, PINs, or encryption keys that your developers failed to clear from variables.
- Static Analysis: We decompile the native wrappers (Java/Kotlin and Swift) to hunt for insecure intents, exported activities, and deep link vulnerabilities that the Dart code might rely upon.
Automated tools miss Flutter flaws
Because Flutter renders everything via the Skia/Impeller engine rather than native UI components, many automated static analysis tools (SAST) fail to properly analyze the application flow. A secure Flutter app requires manual review by engineers who understand the Dart VM architecture.
Frequently asked questions
Is Flutter inherently secure for banking applications?
No framework is inherently secure. While Flutter compiles to native ARM code (making it harder to reverse-engineer than React Native), poorly implemented local storage, weak API encryption, and insecure platform channels can easily compromise a Flutter fintech app.
How do attackers reverse-engineer a Flutter app?
Attackers use tools like Doldrums or reFlutter to parse the compiled `libapp.so` file, extracting Dart class names, strings, and API logic. If you hardcode API keys or encryption secrets in your Dart code, they will be easily recovered.
What is the best way to store session tokens in Flutter?
Never use `SharedPreferences` to store JWTs, BVNs, or PINs, as it saves data in plaintext XML files. You must use `flutter_secure_storage`, which correctly utilizes the Android Keystore and iOS Secure Enclave to cryptographically protect data at rest.
Why do Flutter apps fail penetration tests?
The most common failures are insecure data storage (storing sensitive data without Keystore backing), weak or bypassed SSL pinning implementations, and failing to implement root/jailbreak detection before launching the app.
Related reading
Blog: React Native Security · SSL Pinning Bypasses
Guides: Fintech Security Checklist · OWASP for Fintech
Services: Penetration Testing · API Security Testing