---

Why

Flutter apps hide their logic in libapp.so, ship a 100 MB Dart kernel in debug builds, and bury API keys in assets, resources.arsc and native bridge libraries. The usual advice — "decompile it on your desktop with this toolchain" — is slow, fails on obfuscated AOT snapshots, and needs a matching Dart SDK.

FlutterGuard does the part that works from the phone: it reads the APK the OS already exposes, parses the formats that matter (binary XML, resources.arsc, DEX strings, libapp.so string pool, kernel_blob.bin, NOTICES.Z, env files, X.509 blobs), and produces a report with evidence — all offline, no root, no interception.

It is built to be run repeatedly: every scan is stamped and kept, so the second scan tells you what changed between two versions of the same app. That diff is where the real findings are.

Screenshots

App inventory	Report grade	Findings

Services and SDKs	Settings	Privacy

Store assets and listing copy · App icon · Feature graphic

Select an image to view the full-size store preview.

What it finds

Artifact — package, version, SDK range, ABIs, size, split count, base APK hash, every native library with its size and SHA-256 prefix, installer, signing scheme (v1/v2/v3/v4), signer DN and certificate fingerprints, debug-certificate detection.

Flutter specifics — is this really Flutter, AOT or debug (JIT kernel), kernel_blob.bin size, JIT snapshot presence, Dart engine version, obfuscation state, Dart package inventory recovered from NOTICES.Z and package: URIs, and a fingerprint you can hand to a desktop follow-up (Blutter/reFlutter need the exact engine build).

Manifest risk — permissions, exported activities/services/receivers/providers, debuggable, backup, cleartext policy, network security config (base-config vs domain-config, loopback-only cleartext, user-CA trust, pin sets, debug-overrides), deep links aggregated per scheme.

Secrets and endpoints — API keys (Google, AWS, Stripe, Supabase, Sentry, Firebase, OpenAI, GitHub, Slack, Sendgrid, Telegram), OAuth client IDs, JWT-like blobs, DB/broker URIs with inline credentials, private key blocks with a real body, embedded X.509 certificates (assembled from PEM body lines when a dump splits them), Dart --dart-define names, and .env/.env.prod files with credential counts.

Endpoints — hosts across sources, classified first-party / staging / internal / saas:X / ip-literal, endpoint lists from YAML/TOML service configs (uri: btc-electrum.example:50002 style), API routes from the Dart snapshot, recovered source paths, WebView risk flags, MethodChannel inventory split into app / plugin / standard.

Native surface — flutter_rust_bridge and other FFI bridges, JNI Java_* entry point count.

Third-party and AI surface — the SDK fingerprint table covers ~135 services, each matched by zip path, DEX descriptor, pub package or host: everything from Firebase, Play Services, billing, ads and attribution to auth (Auth0, Clerk, Appwrite, Stytch, WorkOS), realtime (Agora, LiveKit, Stream, Sendbird), payments (Stripe, RevenueCat, PayPal, Paddle), backends (PocketBase, Nhost, Supabase) and vector stores. Large language model providers are inventoried individually — OpenAI, Anthropic, Gemini, Groq, Mistral, Cohere, DeepSeek, OpenRouter, Together, Fireworks, Perplexity, xAI, HuggingFace, Replicate, Bedrock, DashScope, Moonshot, GLM, MiniMax, ElevenLabs, Stability — plus on-device runtimes signalled by localhost:11434 (Ollama) and localhost:1234 (LM Studio) and ComfyUI's :8188. The same pass names the ad, analytics and crash SDKs an app ships, which is usually the most surprising part of a report.

SDK marker files and bundled config — root-level billing.properties, play-services-*.properties, transport-*.properties and firebase-encoders*.properties name the SDK they prove without parsing DEX; bundled .env/.json/.yaml/.properties/.sqlite and key material are listed as config surface; bundled HTML/JS pages are reported as a WebView payload so a local page rendered with a JS bridge is visible rather than implied.