Flutter
Jailbreak and root detection for Flutter apps
There is no Dart source in the package, and that is not the same as being protected. Scan your build today; protecting a Flutter app is not available yet.
Protection engineNot available yet
The protection engine is in preview: builds are registered and scanned, but no protected package is produced yet. This page says exactly what works today.
What attackers do to a Flutter app
The defensive view of the techniques a protection has to make more expensive.
01
Analyzing the compiled Dart
Dart compiles ahead of time to native code, which is harder to read than JavaScript but can still be analyzed. Symbols and strings help the attacker.
02
Rooted and jailbroken devices
On a rooted or jailbroken device, tools such as Frida can hook functions of a running Flutter app.
03
Repackaging
The AAB, APK or IPA can be unpacked, changed and re-signed like any native app.
04
Secrets in assets and strings
Keys left in strings or asset files are readable from the package without running the app.
What Moatgator plans for Flutter
The built artifact is what gets protected, so the plan fits any Flutter build.
Obfuscate Dart in your own build
Use the flutter build flags --obfuscate and --split-debug-info. Moatgator does not replace them.
One policy file
moatgator.yml detects Flutter from pubspec.yaml and reads the Android application id.
Detections in the native layer
Root or jailbreak, debugger, hooking and tampering are evaluated natively. They are not available yet.
Monitor first
Nothing blocks a user until you choose it.
What works today
No promise of support that does not exist yet.
Free Scan of the packages
Scan the AAB, APK or IPA of your Flutter build and get a grade for the protection gaps, read statically.
AvailablePolicy file and CI registration
moatgator.yml detects Flutter and the CLI registers and scans the artifact. Built and tested; the packages are not published yet.
AvailableFlutter protection
Runtime detections and hardening for Flutter are not available yet. No protected package is produced.
Not available yet
Scan the Android build of a Flutter app
The real flow from the documentation.
$ npx moatgator init$ flutter build appbundle --release$ npx moatgator scan build/app/outputs/bundle/release/app-release.aab --min-grade CThe CLI is not published to npm yet. Until it is, use the free Scan in the browser.
Full Flutter quickstartWhat is covered
| Item | Today |
|---|---|
| Package formats (Scan) | AAB, APK and IPA |
| Project type | Flutter, detected from pubspec.yaml |
| Policy and CI registration | Any CI that runs Node 20 or newer |
| Flutter protection | Not available yet |
Tell me when Flutter protection is ready
Leave your email and we will write once, when it is available. Nothing else.
Questions
Is Flutter safer because Dart is compiled?
It is harder to read than a JavaScript bundle, not safe. Compiled code can be analyzed, and strings, assets and symbols are exposed. Treat it as one layer.
Should I use the Flutter obfuscation flags?
Yes: --obfuscate and --split-debug-info in your own build. They are free and complement runtime detections; Moatgator does not replace them.
Can Moatgator detect jailbreak in Flutter today?
Not as a protection. The runtime detections are not available yet. The Scan and the CI registration work today.
Do I get one policy for Android and iOS?
Yes. A single moatgator.yml covers both. Add the iOS bundle id with --bundle-id if it is not detected.
Ready to protect your app?
Start free, or tell us what you need.