Penetration Testing Flutter and React Native Apps

The tester unpacks the package and finds the JavaScript bundle (for example index.android.bundle). If it is not obfuscated, it can be read like source. Searching it often turns up what the team thought was hidden:

$ unzip -q app.apk -d app && grep -oE "(api[_-]?key|secret|Bearer )[^\"']{0,40}" app/assets/index.android.bundle
apiKey: "sk_live_…"        # a secret key shipped to every phone

Anything in the bundle is public. Secret keys, internal URLs, feature flags that unlock paid features and hard-coded admin checks all show up here. Testers also check AsyncStorage for tokens, any over-the-air update mechanism (can the update be tampered with, is it signed?), deep links and the native modules the app adds.

The app logic is in a compiled library. Testers use frameworks that understand Dart's runtime to recover class and method names and to hook functions with Frida. Network interception is the first obstacle. Because the app ignores the device proxy, the tester redirects its traffic at the network level, or uses a patched build, and handles the certificate checks the app does itself. Once traffic is visible, the API tests are the same as for any other app: see intercepting mobile API traffic.

• The server is the security boundary. Whatever the app checks, the attacker can skip.
• Local storage, backups, logs and screenshots.
• Deep links, intents and exported components.
• Third-party SDKs for analytics, payments and push messages, and what data they receive.
• Root and jailbreak checks, which are speed bumps. See the OWASP Mobile Top 10 guide.

• Unpack the release build and search it for keys, tokens and internal host names.
• List what the app writes to disk and what is kept in AsyncStorage or shared preferences.
• Try to intercept the app's traffic as a user would. If you cannot, find out whether that is by design (pinning) or an accident.
• Ask which decisions the app makes on its own that the server should make.

• Keep secrets off the device. Use short-lived tokens issued after sign-in, and keep long-lived keys on your server.
• Store tokens in the platform's secure storage (Keychain, Android Keystore), through a maintained library, and not in AsyncStorage or plain preferences.
• Enable obfuscation for release builds (Flutter's --obfuscate with --split-debug-info, and Hermes bytecode with a minifier for React Native) as a delay, not a defense.
• Sign and verify over-the-air updates.
• Check every sensitive action on the server.

These tests are part of our mobile application Penetration Testing.

To plan a test for your own systems, request a scoping call, or download the pre-test checklist and scoping questionnaire.

Links checked on 5 November 2026.

• OWASP Mobile Application Security Testing Guide, test cases for both platforms
• Flutter documentation, Obfuscate Dart code, obfuscation and debug info
• React Native documentation, Security, storage, networking and updates