Flutter Penetration Testing
Flutter compiles your Dart code into a native binary, and obfuscating it only renames what someone reading it sees. We test what platform channels, storage and build secrets actually reveal. CREST-certified testers, fixed price from £4,240 for a 3-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Flutter compiles Dart into native ARM or x64 code inside libapp.so on Android and inside the app bundle on iOS, and a value passed with –dart-define at build time is compiled into that same binary as a constant. Anyone holding the installed app, or the web bundle for a Flutter web build, can pull both back out.
Why compiling and obfuscating a Flutter app does not make it secure
Flutter’s own documentation on code obfuscation is direct about its limits: the –obfuscate flag “does not encrypt resources nor does it protect against reverse engineering,” it “only renames symbols with more obscure names,” and it only runs on a release build of a native target. Flutter web builds skip obfuscation entirely and rely on standard JavaScript minification instead, so the compiled Dart logic behind a web build is a smaller step away from readable than the native binary is. We treat obfuscation as noise to work around rather than a control that stops us, and test what a released app or web bundle actually exposes once it is decompiled or unpacked.
Every call from your Dart code to native Android or iOS code crosses a platform channel, a named MethodChannel, EventChannel or BasicMessageChannel that Flutter’s own documentation describes as “not type safe”: calling and receiving messages depends on the Dart and native sides declaring the same channel name and the same argument types for anything to work. Messages are serialised with the StandardMessageCodec by default and handled on the host platform’s own thread unless a plugin explicitly requests otherwise. We test what a native plugin does with the arguments it receives over that channel, and whether the permission or validation your Dart code assumes actually exists on the native side that implements it, and map these checks to OWASP’s Mobile Application Security Verification Standard requirements for platform interaction.
Data written with shared_preferences sits in plain platform storage, since Flutter’s own package listing confirms it simply wraps NSUserDefaults on iOS and SharedPreferences on Android, not the Keychain and cipher-backed Android storage that flutter_secure_storage uses instead. The same gap applies to configuration: a value passed with –dart-define or –dart-define-from-file at build time becomes a constant compiled into the release binary, no different in kind to a hardcoded string. This page tests only your Flutter build; where you also ship a React Native app against the same backend, see our React Native and Flutter penetration testing page for testing both together.
SCOPE
What we pen test on a Flutter application
Dart AOT Compilation and Binary Reverse Engineering
Flutter compiles Dart to native ARM or x64 code that ships inside libapp.so on Android and inside the app bundle on iOS, and Flutter’s own documentation states plainly that obfuscating that binary renames symbols only, it does not encrypt resources or stop reverse engineering. We pull the release binary apart the way an attacker would, obfuscated or not, and check what business logic, endpoints and validation rules are recoverable from it.
Platform Channel Message Boundaries
A MethodChannel, EventChannel or BasicMessageChannel is identified only by a name string that the Dart and native sides must both declare, and Flutter’s documentation notes these channels are not type safe, since matching arguments and types across that boundary is left entirely to the two sides agreeing. We test every channel your app registers for a native handler that trusts an argument, a type or a caller it should not.
Native Plugin Implementation Review
Every plugin ships real Kotlin, Java, Swift or Objective-C code that runs with the full permissions of your app on that platform, independently of anything the Dart layer enforces. We review the native side of any custom or third-party plugin in scope for the access, storage and validation decisions it makes once a platform channel call reaches it.
Local Storage: shared_preferences vs flutter_secure_storage
shared_preferences wraps NSUserDefaults on iOS and SharedPreferences on Android, both plain platform key-value stores with no encryption of their own, while flutter_secure_storage backs onto the iOS Keychain and cipher-backed Android storage instead. We check what your app actually writes to each store, and whether a token, credential or personal record has landed in the unencrypted one.
Certificate Validation and Pinning Bypass
Where an app pins a certificate or public key rather than trusting the device’s certificate store, that check is implemented in your own networking code or a plugin you chose, not by Flutter itself. We test whether the pinning logic actually rejects a substituted certificate, and what happens to the app once it does, since a pinning failure that only logs a warning is not a control.
Traffic Interception and Proxy Behaviour
Dart’s HttpClient resolves the proxy for a connection through a findProxy function that an app sets itself, rather than automatically inheriting whatever proxy is configured on the device, which is why pointing a device at an interception proxy does not always put every request from a Flutter app through it. We account for this during testing and confirm every code path an app uses to reach the network, not only the ones an intercepting proxy happens to catch.
Deep Links and App Links
Flutter supports a plain custom URL scheme, which any app on the device can register, alongside Android App Links and iOS Universal Links, which Flutter’s own deep linking guide points to as the verified route tied to a domain you control. We test every deep link your app accepts for the input it trusts once it lands on a screen, and whether an unverified scheme is still doing work a verified one should be doing instead.
Build Secrets and –dart-define Configuration
A value passed with –dart-define or –dart-define-from-file becomes a compile-time constant baked into the release binary, in the same way Flutter’s own build flavour configuration bakes an appFlavor value into the build. We check every build flag and constant your pipeline injects for an API key, signing value or backend URL that should never have shipped inside a binary a customer can extract.
Server-Side Authorisation Behind the App
Every screen, button and validation rule inside your Flutter app is a decision the client makes, and the API behind it has to enforce that same decision independently, or a modified client, a replayed request or a direct call to the endpoint bypasses it entirely. We test the backend your Flutter app talks to for authorisation that actually matches what the app’s interface implies, not authorisation the interface merely assumes.
Flutter Web Build Exposure
A Flutter web build compiles the same Dart code to JavaScript or WebAssembly and ships it to a browser rather than an app store, and Flutter’s own documentation confirms a release web build is minified rather than obfuscated, since Flutter has no obfuscation step for web at all. We test what business logic, routes and validation are readable directly in a browser’s developer tools once that build reaches a user.
OUR PROCESS
Flutter Penetration Testing: From Scope to Attestation
Scope and Build Mapping
We agree the platforms, backend environment and any release or debug build variants in scope, and map every platform channel, plugin and stored data location before testing begins.
Binary and Storage Review
We unpack the release binary or web bundle, review what obfuscation or minification actually hid, and inspect local storage, channel names and any build-time constants compiled into the app.
Manual Exploitation
CREST-certified testers manually test platform channel boundaries, certificate pinning, deep link handling and server-side authorisation, chaining findings across the client and the API it talks to.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Flutter pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Flutter Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 5 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote7 to 9 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Flutter For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Flutter Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Flutter app?
We need the release build, the APK, IPA or web bundle, that you actually ship, plus at least one authenticated account for every role or permission level the app exposes. Where you use –dart-define or –dart-define-from-file for build configuration, the flags and files used for the build under test speed up scoping, though we do not need your source code to start.
Will testing touch our live data?
We test whichever environment and backend you give us access to. If that is production, we agree exclusions upfront, such as bulk deletes, push notifications or in-app purchases, and we do not run destructive tests against real customer records without that agreement in writing.
How long does a Flutter penetration test take?
A single Flutter application sits in our 3-day single-framework scope, with a report typically landing around 5 to 7 working days after kickoff. An app with a wider role matrix, multiple backend integrations or a companion web build moves into a larger scope with more testing days.
Do you test the iOS and Android builds separately?
Yes, where both are in scope. Platform channels and native plugins are implemented separately for each platform, so a bypass or a missing check found on one side does not tell us the other side is safe, and we test both.
Is a Flutter web build covered in the same test?
Yes. A Flutter web build compiles the same Dart code to JavaScript or WebAssembly rather than a native binary, and since Flutter applies no obfuscation to web builds, we test what business logic and routes are directly readable in a browser once the release build ships.
What is out of scope for a single-framework Flutter test?
The backend API and infrastructure your app talks to are out of scope for this test and covered by our API and cloud penetration testing services instead. A companion React Native build for the same product is also scoped and quoted separately, or together under our React Native and Flutter penetration testing service.
Do you need our source code?
No. Testing is black-box against the release build by default. A grey-box option, where we review the relevant platform channel, storage and networking code alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Flutter have a customer penetration-testing policy we need to follow?
No. Flutter is an open-source SDK you build and ship yourself rather than a shared multi-tenant service, so there is no vendor notification process to follow before testing your app. Where your app talks to backend services hosted on a shared cloud or managed platform, that provider’s own penetration-testing policy still applies, and we confirm its current terms with you during scoping.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Flutter application
Flutter compiles your Dart code into a native binary, and obfuscating it only renames what someone reading it sees. We test what platform channels, storage and build secrets actually reveal. CREST-certified testers, fixed price from £4,240 for a 3-day single-framework scope, quoted within 24 hours.
